SSH.com Communications SSH Tectia Authentication Bypass Remote Zeroday Exploit

[wind]

http://www.exploit-db.com/sploits/23082.zip

SSH Tectia Remote Authentication Bypass

Tectia is the commercial OpenSSH solution. The product can be found at:

SSH Key Management, Privileged Access Control, Identity and Access Governance, Data-in-Transit

An attacker in the possession of a valid username of an SSH Tectia installation running on UNIX (verified: AIX/Linux) can login without a password.

The bug is in the SSH USERAUTH CHANGE REQUEST routines which are there to allow a user to change their password. A bug in this code allows an attacker to login without a password by forcing a password change request prior to authentication.

The vulnerability has been verified on UNIX operating systems and at least on this (recent) versions:

• SSH-2.0-6.1.9.95 SSH Tectia Server (Latest available version from SSH Key Management, Privileged Access Control, Identity and Access Governance, Data-in-Transit)

• SSH-2.0-6.0.11.5 SSH Tectia Server

A default installation on Linux (version 6.1.9.95 of Tectia) is vulnerable to the attack.

Asta pare interesant, cand am chef o sa-l incerc .