SSH Tectia Windows Path Specification Privilege Escalation Vulnerability

Bugtraq ID:	19679
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Aug 23 2006 12:00AM
Updated:	Aug 31 2006 12:23AM
Credit:	Mr. Charles Morris is credited for the discovery of this issue.
Vulnerable:	SSH Communications Security Tectia Server 5.0.1 SSH Communications Security Tectia Server 5.0 SSH Communications Security Tectia Server 4.4.5 SSH Communications Security Tectia Server 4.4.3 SSH Communications Security Tectia Server 4.4.2 SSH Communications Security Tectia Server 4.4 SSH Communications Security Tectia Server 4.3.7 SSH Communications Security Tectia Server 4.3.6 SSH Communications Security Tectia Server 4.3.5 SSH Communications Security Tectia Server 4.3.4 SSH Communications Security Tectia Server 4.3.3 SSH Communications Security Tectia Server 4.3.2 SSH Communications Security Tectia Server 4.3.1 SSH Communications Security Tectia Server 4.3 SSH Communications Security Tectia Server 4.2.1 SSH Communications Security Tectia Server 4.0.5 SSH Communications Security Tectia Server 4.0.4 SSH Communications Security Tectia Server 4.0.3 SSH Communications Security Tectia Server 4.0 SSH Communications Security Tectia Server 6.10 SSH Communications Security Tectia Manager 2.1.2 SSH Communications Security Tectia Connector 5.0.1 SSH Communications Security Tectia Connector 5.0 SSH Communications Security Tectia Client 5.0.1 SSH Communications Security Tectia Client 5.0 SSH Communications Security Tectia Client 4.4.5 SSH Communications Security Tectia Client 4.4.4 SSH Communications Security Tectia Client 4.4.3 SSH Communications Security Tectia Client 4.4.2 SSH Communications Security Tectia Client 4.4.1 SSH Communications Security Tectia Client 4.4 SSH Communications Security Tectia Client 4.3.8 K SSH Communications Security Tectia Client 4.3.7 SSH Communications Security Tectia Client 4.3.6 SSH Communications Security Tectia Client 4.3.5 SSH Communications Security Tectia Client 4.3.4 SSH Communications Security Tectia Client 4.3.3 SSH Communications Security Tectia Client 4.3.2 SSH Communications Security Tectia Client 4.3.1 J SSH Communications Security Tectia Client 4.3.1 SSH Communications Security Tectia Client 4.3 SSH Communications Security Tectia Client 4.2.1 SSH Communications Security Tectia Client 4.2 SSH Communications Security Tectia Client 4.0.5 SSH Communications Security Tectia Client 4.0.4 SSH Communications Security Tectia Client 4.0.3 SSH Communications Security Tectia Client 4.0.1 SSH Communications Security Tectia Client 4.0 SSH Communications Security SSH Tectia Manager 1.4 SSH Communications Security SSH Tectia Manager 1.3
Not Vulnerable:	SSH Communications Security Tectia Server 5.1 SSH Communications Security Tectia Server 5.0.2 SSH Communications Security Tectia Server 4.4.6 SSH Communications Security Tectia Manager 2.2 SSH Communications Security Tectia Manager 2.1.3 SSH Communications Security Tectia Connector 5.1 SSH Communications Security Tectia Connector 5.0.2 SSH Communications Security Tectia Client 5.1 SSH Communications Security Tectia Client 5.0.2 SSH Communications Security Tectia Client 4.4.6 SSH Communications Security Tectia Client 4.3.9 k SSH Communications Security Tectia Client 4.3.2 J

SSH Tectia Windows Path Specification Privilege Escalation Vulnerability

SSH Tectia is affected by a path-parsing bug that may allow arbitrary file execution with system or other users' privileges.

SSH Tectia Windows Path Specification Privilege Escalation Vulnerability

Attackers use standard system utilities to exploit this issue.

SSH Tectia Windows Path Specification Privilege Escalation Vulnerability

Solution:
The vendor has released fixes for this issue. Visit the Tectia Maintenance Release Downloads page listed under References to find releases specific to your product version.

SSH Tectia Windows Path Specification Privilege Escalation Vulnerability

References:

• August 23 2006 advisory (SSH Communications Security)
  
• Maintenance Release Downloads (SSH Communications Security)
  
• Vendor Homepage (SSH Communications Security)