14 lines
No EOL
937 B
Text
14 lines
No EOL
937 B
Text
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/23082.zip
|
|
|
|
SSH Tectia Remote Authentication Bypass
|
|
Tectia is the commercial OpenSSH solution. The product can be found at:
|
|
www.tectia.com
|
|
An attacker in the possession of a valid username of an SSH Tectia installation running on UNIX (verified: AIX/Linux) can login without a password.
|
|
The bug is in the SSH USERAUTH CHANGE REQUEST routines which are there to allow a user to change their password. A bug in this code allows an attacker to login without a password by forcing a password change request prior to authentication.
|
|
|
|
The vulnerability has been verified on UNIX operating systems and at least on this (recent) versions:
|
|
• SSH-2.0-6.1.9.95 SSH Tectia Server (Latest available version from www.tectia.com)
|
|
• SSH-2.0-6.0.11.5 SSH Tectia Server
|
|
A default installation on Linux (version 6.1.9.95 of Tectia) is vulnerable to the attack.
|
|
|
|
Kingcope |