SecureCRT SSH1 Identifier String Buffer Overflow Vulnerability

Bugtraq ID:	5287
Class:	Boundary Condition Error
CVE:	CVE-2002-1059
Remote:	Yes
Local:	No
Published:	Jul 23 2002 12:00AM
Updated:	Aug 10 2006 11:30PM
Credit:	Discovery of this issue is credited to Kyuzo <[email protected]>.
Vulnerable:	VanDyke SecureCRT 4.0 beta 2 VanDyke SecureCRT 4.0 beta 1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional VanDyke SecureCRT 3.4.5 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional VanDyke SecureCRT 3.4.4 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional VanDyke SecureCRT 3.4.3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional VanDyke SecureCRT 3.4.2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional VanDyke SecureCRT 3.4.1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional VanDyke SecureCRT 3.4 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional VanDyke SecureCRT 3.3.3 VanDyke SecureCRT 3.3.2 VanDyke SecureCRT 3.3.1 VanDyke SecureCRT 3.3 VanDyke SecureCRT 3.2.1 VanDyke SecureCRT 3.2 VanDyke SecureCRT 3.1.2 VanDyke SecureCRT 3.1.1 VanDyke SecureCRT 3.1 VanDyke SecureCRT 3.0 VanDyke SecureCRT 2.4
Not Vulnerable:	VanDyke SecureCRT 4.0 beta 3 VanDyke SecureCRT 3.4.6 VanDyke SecureCRT 3.3.4 VanDyke SecureCRT 3.2.2

SecureCRT SSH1 Identifier String Buffer Overflow Vulnerability

The SecureCRT client is prone to a buffer-overflow condition when attempting to handle an overly long SSH1 protocol identifier string. Reportedly, an attacker can exploit this issue via a malicious server.

Exploiting this issue may allow an attacker to execute arbitrary code or may cause the client to crash.

SecureCRT SSH1 Identifier String Buffer Overflow Vulnerability

Exploit code has been developed by "Andrea Lisci" <[email protected]>.

A proof-of-concept program to demonstrate the overflow condition was submitted by Kyuzo <[email protected]>.

CORE has developed a working commercial exploit for their IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

A Metasploit exploit module is available.

• /data/vulnerabilities/exploits/securecrt_ssh1.pm
• /data/vulnerabilities/exploits/securecrtpoc.c
• /data/vulnerabilities/exploits/securecrt-exp.c

SecureCRT SSH1 Identifier String Buffer Overflow Vulnerability

Solution:
The vendor has supplied fixes that address this issue.

SecureCRT users who purchased licenses before January 1, 2000 should upgrade to SecureCRT 3.2.2.

SecureCRT users who purchased licenses before July 1, 2000 should upgrade to SecureCRT 3.3.4.

Secure CRT users who purchased licenses on or later than June 1, 2001 should
upgrade to SecureCRT 3.4.6 or SecureCRT 4.0 beta 3.


VanDyke SecureCRT 2.4

• Van Dyke Technologies SecureCRT 3.2.2
  http://www.vandyke.com/download/securecrt/3.2/index.html

VanDyke SecureCRT 3.0

• Van Dyke Technologies SecureCRT 3.2.2
  http://www.vandyke.com/download/securecrt/3.2/index.html


• Van Dyke Technologies SecureCRT 3.4.6
  http://www.vandyke.com/download/securecrt/index.html

VanDyke SecureCRT 3.1

• Van Dyke Technologies SecureCRT 3.2.2
  http://www.vandyke.com/download/securecrt/3.2/index.html

VanDyke SecureCRT 3.1.1

• Van Dyke Technologies SecureCRT 3.2.2
  http://www.vandyke.com/download/securecrt/3.2/index.html

VanDyke SecureCRT 3.1.2

• Van Dyke Technologies SecureCRT 3.2.2
  http://www.vandyke.com/download/securecrt/3.2/index.html

VanDyke SecureCRT 3.2

• Van Dyke Technologies SecureCRT 3.2.2
  http://www.vandyke.com/download/securecrt/3.2/index.html

VanDyke SecureCRT 3.2.1

• Van Dyke Technologies SecureCRT 3.2.2
  http://www.vandyke.com/download/securecrt/3.2/index.html

VanDyke SecureCRT 3.3

• Van Dyke Technologies SecureCRT 3.3.4
  http://www.vandyke.com/download/securecrt/3.3/index.html

VanDyke SecureCRT 3.3.1

• Van Dyke Technologies SecureCRT 3.3.4
  http://www.vandyke.com/download/securecrt/3.3/index.html

VanDyke SecureCRT 3.3.2

• Van Dyke Technologies SecureCRT 3.3.4
  http://www.vandyke.com/download/securecrt/3.3/index.html

VanDyke SecureCRT 3.3.3

• Van Dyke Technologies SecureCRT 3.3.4
  http://www.vandyke.com/download/securecrt/3.3/index.html

VanDyke SecureCRT 3.4

• Van Dyke Technologies SecureCRT 3.4.6
  http://www.vandyke.com/download/securecrt/index.html

VanDyke SecureCRT 3.4.1

• Van Dyke Technologies SecureCRT 3.4.6
  http://www.vandyke.com/download/securecrt/index.html

VanDyke SecureCRT 3.4.2

• Van Dyke Technologies SecureCRT 3.4.6
  http://www.vandyke.com/download/securecrt/index.html

VanDyke SecureCRT 3.4.3

• Van Dyke Technologies SecureCRT 3.4.6
  http://www.vandyke.com/download/securecrt/index.html

VanDyke SecureCRT 3.4.4

• Van Dyke Technologies SecureCRT 3.4.6
  http://www.vandyke.com/download/securecrt/index.html

VanDyke SecureCRT 3.4.5

• Van Dyke Technologies SecureCRT 3.4.6
  http://www.vandyke.com/download/securecrt/index.html

VanDyke SecureCRT 4.0 beta 2

• Van Dyke Technologies SecureCRT 4.0 beta 3
  http://www.vandyke.com/download/securecrt/beta.html

VanDyke SecureCRT 4.0 beta 1

• Van Dyke Technologies SecureCRT 4.0 beta 3
  http://www.vandyke.com/download/securecrt/beta.html

SecureCRT SSH1 Identifier String Buffer Overflow Vulnerability

References:

• Advisory Notification Van Dyke SecureCRT Discloses Password to Local Users (Full Disclosure)
  
• SecureCRT Exploit Proxy (CORE Security)
  
• Security Advisory -- SecureCRT 2.x, 3.x, 4.0 beta (Van Dyke Technologies)