[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : SSH.com Communications SSH Tectia Authentication Bypass Remote Zeroday Exploit
# Published : 2012-12-02
# Author :
# Previous Title : NFR Agent FSFUI Record File Upload RCE
# Next Title : Oracle Database Client System Analyzer Arbitrary File Upload


SSH Tectia Remote Authentication Bypass
Tectia is the commercial OpenSSH solution. The product can be found at:
An attacker in the possession of a valid username of an SSH Tectia installation running on UNIX (verified: AIX/Linux) can login without a password.
The bug is in the SSH USERAUTH CHANGE REQUEST routines which are there to allow a user to change their password. A bug in this code allows an attacker to login without a password by forcing a password change request prior to authentication.

The vulnerability has been verified on UNIX operating systems and at least on this (recent) versions:
? SSH-2.0- SSH Tectia Server (Latest available version from www.tectia.com)
? SSH-2.0- SSH Tectia Server
A default installation on Linux (version of Tectia) is vulnerable to the attack.