CVE-2008-0132 Pragma FortressSSH 5.0 Build 4 Revision 293 and earlier handles long input to sshd.exe by creating an error-message window and waiting for the administrator to click in this window before terminating....
MediumCVSS 5.0
EPSS 9.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Pragma FortressSSH 5.0 Build 4 Revision 293 and earlier handles long input to sshd.exe by creating an error-message window and waiting for the administrator to click in this window before terminating the sshd.exe process, which allows remote attackers to cause a denial of service (connection slot exhaustion) via a flood of SSH connections with long data objects, as demonstrated by (1) a long list of keys and (2) a long username.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pragmasys fortress ssh | < 5.0 | 5.0 |
| pragmasys fortress ssh | = 5.0-build4_revision293 | No fix listed |
References
- aluigi.altervista.org third-party-advisory
- aluigi.org third-party-advisory
- 20080104 Some DoS in some telnet servers issue-tracking mailing-list third-party-advisory
- 27141 third-party-advisory vdb-entry
- fortressssh-sshd-dos(39354) third-party-advisory vdb-entry