Detections
Analytics

AttachmateWRQ Reflection for Secure IT Server SFTP Format String

medium Nessus Network Monitor Plugin ID 3428

Synopsis

The remote SSH server is affected by a format string vulnerability.

Description

The remote SSH server is affected by a format string vulnerability. The remote host is running AttachmateWRQ Reflection for Secure IT Server / F-Secure SSH Server, a commercial SSH server. According to its banner, the installed version of this software contains a format string vulnerability in its SFTP subsystem. An remote authenticated attacker may be able to execute arbitrary code on the affected host subject to his privileges or crash the server itself.

Solution

Upgrade or patch according to vendor recommendations or edit the software's configuration to disable the SFTP subsystem.

See Also

http://www.kb.cert.org/vuls/id/419241

http://support.wrq.com/techdocs/1882.html

Plugin Details

Severity: Medium

ID: 3428

Family: SSH

Published: 2/14/2006

Updated: 3/6/2019

Nessus ID: 20902

Risk Information

VPR

Risk Factor: Medium

Score: 5.8

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.5

Vector: CVSS2#AV:A/AC:M/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.7

Vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Reference Information

CVE: CVE-2006-0705

BID: 16640, 16625