SSH Tectia Server SFTP Filename Logging Format String

Medium Nessus Network Monitor Plugin ID 3432

Synopsis

The remote SSH server may be affected by a format string vulnerability.

Description

The remote host is running SSH Tectia Server, a commercial SSH server. According to its banner, the installed version of this software contains a format string vulnerability in its SFTP subsystem. An authenticated remote attacker may be able to execute arbitrary code on the affected host subject to his privileges or crash the server itself.

Solution

Upgrade to version 4.3.7, 4.4.2 or higher.

See Also

http://www.ssh.com/company/newsroom/article/715

Plugin Details

Severity: Medium

ID: 3432

Family: SSH

Published: 2006/02/15

Modified: 2018/09/16

Dependencies: 1967, 3059

Nessus ID: 20927

Risk Information

Risk Factor: Medium

CVSSv2

Base Score: 5.4

Temporal Score: 4.5

Vector: CVSS2#AV:A/AC:M/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSSv3

Base Score: 5

Temporal Score: 4.7

Vector: CVSS3#AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS3#E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:ssh:tectia_server

Reference Information

CVE: CVE-2006-0705

BID: 16625, 16640