FreeSSHd SFTP 'rename' And 'realpath' Remote DoS Vulnerability Network Vulnerability

Summary

The host is running freeSSHd SSH server and is prone to remote denial of service vulnerability. NULL pointer de-referencing errors in SFTP 'rename' and 'realpath' commands. These can be exploited by passing overly long string passed as an argument to the affected commands.

Impact

Successful exploitation will cause denial of service. Impact Level: Application

Solution

Upgrade to freeSSHd version 1.2.6 or later. For updates refer to http://www.freesshd.com/index.php?ctt=download

Affected

freeSSHd freeSSHd version 1.2.1.14 and prior on Windows (all)

References