FreeSSHd freeSSHd.exe Remote Authentication Bypass Vulnerability

Release date: 2012-3 3
Updated on:

Affected Systems:
FreeSSHd 1.2.6
Description:
--------------------------------------------------------------------------------
Bugtraq id: 56785
CVE (CAN) ID: CVE-2012-6066
 
FreeSSHd is an open-source SSH and SFTP server.
 
FreeFTPd and its built-in SFTP server have the Authentication Bypass Vulnerability. Before providing a certificate, open the SSH channel to bypass authentication. Unauthenticated remote attackers can exploit this vulnerability to log on without providing any certificates. After logging on, they can upload specially crafted files to execute arbitrary code with SYSTEM privileges.
 
<* Source: Kingdom (kingcope@gmx.net)

Link: http://xforce.iss.net/xforce/xfdb/80476
Http://web.nvd.nist.gov/view/vuln/detail? VulnId = CVE-2012-6066
Http://www.tenable.com/plugins/index.php? View = single/id = 63223
Http://www.exploit-db.com/exploits/23080/
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
FreeSSHD all version Remote Authentication Bypass ZERODAY
Discovered & Exploited by Kingdom
Year 2011

Http://www.exploit-db.com/sploits/23080.zip

Run like:

Ssh.exe-l <valid username>

Valid username might be:

Root
Admin
Administrator
Webadmin
Sysadmin
Netadmin
Guest
User
Web
Test
Ssh
Sftp
Ftp

Or anything you can imagine.

The vulnerable banner of the most recent version is:

SSH-2.0-WeOnlyDo 2.1.3.

For your pleasure,

KingcopeFreeSSHD all version Remote Authentication Bypass ZERODAY
Discovered & Exploited by Kingdom
Year 2011

Run like:

Ssh.exe-l <valid username>

Valid username might be:

Root
Admin
Administrator
Webadmin
Sysadmin
Netadmin
Guest
User
Web
Test
Ssh
Sftp
Ftp

Or anything you can imagine.

The vulnerable banner of the most recent version is:

SSH-2.0-WeOnlyDo 2.1.3.

For your pleasure,

Kingdom

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
FreeSSHd
--------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:
 
Http://freesshd.com/