Quantum Secular Labs / Blog / Advisories

CVE-2002-1360: Multiple SSH2 servers and clients do not properly handle strings with null characters in them when the…

CVE-2002-1360 has a CVSS v2 base score of 10.0 (the maximum on that scale) and NVD lists 7 affected products, including Cisco IOS. Per its scoring, it can be exploited over the network, without authentication. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

Multiple SSH2 servers and clients do not properly handle strings with null characters in them when the string length is specified by a length field, which could allow remote attackers to cause a denial of service or possibly execute arbitrary code due to interactions with the use of null-terminated strings as implemented using languages such as C, as demonstrated by the SSHredder SSH protocol test suite.

Severity breakdown

CVSS v2.0 10.0: AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access vector: Network. Exploitable remotely over the network.
  • Access complexity: Low. No special conditions are required.
  • Authentication: None. No authentication is needed.
  • Confidentiality impact: Complete. Total information disclosure.
  • Integrity impact: Complete. Total loss of integrity.
  • Availability impact: Complete. Total shutdown of the component.

Underlying weakness

CWE-20: Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected products

  • Cisco IOS: 12.0s; 12.0st; 12.1e; 12.1ea; 12.1t; 12.2; 12.2s; 12.2t
  • Fissh SSH Client: 1.0a_for_windows
  • Intersoft Securenetterm: 5.4.1
  • Netcomposite Shellguard SSH: 3.4.6
  • Pragma Systems Secureshell: 2.0
  • Putty: 0.48; 0.49; 0.53
  • Winscp: 2.0.0

References