SSH Clients and Servers: Buffer Overflows and Code Execution Threats

Some SSH clients and servers have buffer overflows in the key exchange initialization and startup code that may be exploitable by a remote attacker in a denial-of-service attack or, under some conditions, allow the execution of arbitrary code as the root . . . Some SSH clients and servers have buffer overflows in the key exchange initialization and startup code that may be exploitable by a remote attacker in a denial-of-service attack or, under some conditions, allow the execution of arbitrary code as the root user. These buffer overflows are in code that is executed prior to user authentication. Implementations of SSH that have been reported to be vulnerable by at least one source include: F-Secure Corp's SSH servers and clients for Unix (v3.1.0 build 11 and older) and Windows (v5.2 and older); SSH Communications Security, Inc. SSH for Unix and Windows (v3.2.2 and older); FiSSH SSH client for Windows (v1.0A and older); SecureNetTerm client for Windows (v5.4.1 and older) NetComposite ShellGuard SSH client for Windows (v3.4.6 and older); Pragma Systems, Inc. SecureShell SSH server for Windows (v2 and older); PuTTY SSH client for Windows (v0.53 and older); and WinSCP SCP client for Windows (v2.0.0 and older). A trojan SSH server has been released that exploits this problem in the PuTTY SSH client.