CVE-2012-5975
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
50Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendepss 36%
de la publicación al armael mismo día
Publicada en NVD4 dic
1ª PoC2 dic
metasploit1 dic
The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6.2.5, and 6.3.0 through 6.3.2 on UNIX and Linux, when old-style password authentication is enabled, allows remote attackers to bypass authentication via a crafted session involving entry of blank passwords, as demonstrated by a root login session from a modified OpenSSH client with an added input_userauth_passwd_changereq call in sshconnect2.c.
Productos afectados
n/a · n/aPoCs públicas encontradas — 3✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/23082exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/23156cve_referencewww.exploit-db.com/exploits/23082/no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0013.htmlhttp://archives.neohapsis.com/archives/fulldisclosure/2012-12/0065.htmlhttps://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/ssh/tectia_passwd_changereq.rbhttp://www.exploit-db.com/exploits/23082/