Van Dyke SecureCRT Remote Denial of Service Vulnerability

Bugtraq ID:	12122
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 29 2004 12:00AM
Updated:	Dec 29 2004 12:00AM
Credit:	Discovery is credited to Wang Ning <[email protected]>.
Vulnerable:	VanDyke SecureCRT 3.4 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional
Not Vulnerable:

Van Dyke SecureCRT Remote Denial of Service Vulnerability

SecureCRT is reported prone to a remote denial of service vulnerability. It is reported that supplying an excessive string value the application through the hostname field may trigger this vulnerability. Apparently, this causes the client application to crash.

This issue is reported to affect SecureCRT 3.4.

Van Dyke SecureCRT Remote Denial of Service Vulnerability

An exploit is not required.

Van Dyke SecureCRT Remote Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Van Dyke SecureCRT Remote Denial of Service Vulnerability

References:

• Advisory Notification Van Dyke SecureCRT Discloses Password to Local Users (Full Disclosure)