CVE-2003-0826 lsh daemon (lshd) does not properly return from certain functions in (1) read_line.c, (2) channel_commands.c, or (3) client_keyexchange.c when long input is provided, which could allow remote attacker...
HighCVSS 7.5
EPSS 12.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
lsh daemon (lshd) does not properly return from certain functions in (1) read_line.c, (2) channel_commands.c, or (3) client_keyexchange.c when long input is provided, which could allow remote attackers to execute arbitrary code via a heap-based buffer overflow attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU lsh | = 1.4 | No fix listed |
| GNU lsh | = 1.4.1 | No fix listed |
| GNU lsh | = 1.4.2 | No fix listed |
| debian/lsh-utils(Debian:12) | < 1.4.2-6 | 1.4.2-6 |
References
- Debian Security Tracker CVE-2003-0826 vendor-advisory
- bugs.debian.org
- 20030919 lsh patch (was Re: [Full-Disclosure] new ssh exploit?) mailing-list
- lists.lysator.liu.se
- 20030919 Remote root vuln in lsh 1.4.x mailing-list
- 20030920 LSH: Buffer overrun and remote root compromise in lshd mailing-list
- DSA-717 vendor-advisory