Bugtraq mailing list archives
RE: Arbitrary Code Execution Vulnerability in VanDyke SecureCRT 3.4 & 4.0 beta
From: "Burton M. Strauss III" <bstrauss3 () attbi com>
Date: Fri, 26 Jul 2002 15:42:10 -0500
You know, that's only partially a solution. For those of us who haven't chosen to PAY for the upgrade to 3.4, we're left out in the cold. Quoting from VanDyke's web page: "All users may evaluate SecureCRT 3.4 for 30 days free of charge. Registered users who purchased licenses before July 1, 2000 should consult the Upgrade Eligibility page to learn about licensing the 3.4 upgrade." and "SecureCRT Upgrade Registered users who purchased licenses before July 1, 2001 may choose to purchase SecureCRT upgrades starting at $39.95 for a single copy. <snip /> SecureCRT users who purchased licenses between January 1 and July 1, 2000 are eligible to download SecureCRT 3.3.3 and upgrade without charge. SecureCRT users who purchased licenses before January 1, 2000 are eligible to download SecureCRT 3.2.1 and upgrade without charge." I'm not unsympathetic to the need to have a licensing revenue stream, but let's remember that this leaves (dozens? hundreds? thousands? Just me) of your customers unprotected. -----Burton -----Original Message----- From: kelli burkinshaw [mailto:kelli.burkinshaw () vandyke com] Sent: Thursday, July 25, 2002 5:33 PM To: bugtraq () securityfocus com Subject: Re: Arbitrary Code Execution Vulnerability in VanDyke SecureCRT 3.4 & 4.0 beta In-Reply-To: <20020722200944.A6030 () SirDrinkalot rm-f net>
SecureCRT (http://www.vandyke.com/products/securecrt/) seems to have a bug in a seemlingly trivial portion of its SSH connection code. When an SSH Client connects to a server, the server sends a version string containing minor and major numbers for the protocol, as well as a server-specific identifier string which is specified to be no more than 40 bytes long. Unfortunetly the SecureCRT code which handles errors relating to an unsupported protocol version contains an unchecked buffer overflow when dealing with this identifier string.
VanDyke Software has released SecureCRT version 3.4.6 and version 4.0 beta 3 to eliminate the issue in SecureCRT you describe above. The issue made SecureCRT vulnerable to a buffer overflow attack which could allow malicious parties to execute arbitrary code when connecting to an SSH1 server that has been modified to perform this exploit. SSH2 connections are not affected by the vulnerability. VanDyke Software recommends that anyone using SecureCRT versions 2.x, 3.x, or 4.x upgrade immediately to the available revisions. For more details and to download a new version see: http://www.vandyke.com/products/securecrt/security07-25-02.html -- kelli burkinshaw VanDyke Software kelli.burkinshaw () vandyke com Product Director http://www.vandyke.com 505.332.5700 (T) 505.332.5701 (F)
Current thread:
- Re: Arbitrary Code Execution Vulnerability in VanDyke SecureCRT 3.4 & 4.0 beta kelli burkinshaw (Jul 23)
- <Possible follow-ups>
- Re: Arbitrary Code Execution Vulnerability in VanDyke SecureCRT 3.4 & 4.0 beta kelli burkinshaw (Jul 25)
- RE: Arbitrary Code Execution Vulnerability in VanDyke SecureCRT 3.4 & 4.0 beta Burton M. Strauss III (Jul 26)
- Re: Arbitrary Code Execution Vulnerability in VanDyke SecureCRT 3.4 & 4.0 beta Bela Lubkin (Jul 27)
- Re: Arbitrary Code Execution Vulnerability in VanDyke SecureCRT 3.4 & 4.0 beta Bela Lubkin (Jul 28)
- Re: Arbitrary Code Execution Vulnerability in VanDyke SecureCRT 3.4 & 4.0 beta Russell Harding (Jul 28)
- Re: Arbitrary Code Execution Vulnerability in VanDyke SecureCRT 3.4 & 4.0 beta Bela Lubkin (Jul 28)
- Re: Arbitrary Code Execution Vulnerability in VanDyke SecureCRT 3.4 & 4.0 beta Jim Paris (Jul 29)
- RE: Arbitrary Code Execution Vulnerability in VanDyke SecureCRT 3.4 & 4.0 beta Burton M. Strauss III (Jul 26)