Vulnerability Name:

CVE-2012-5975 (CCN-80454)

Assigned:2012-12-02
Published:2012-12-02
Updated:2012-12-05
Summary:The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6.2.5, and 6.3.0 through 6.3.2 on UNIX and Linux, when old-style password authentication is enabled, allows remote attackers to bypass authentication via a crafted session involving entry of blank passwords, as demonstrated by a root login session from a modified OpenSSH client with an added input_userauth_passwd_changereq call in sshconnect2.c.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
7.7 High (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
4.1 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:F/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-287
Vulnerability Consequences:Bypass Security
References:Source: FULLDISC
Type: UNKNOWN
20121201 SSH.com Communications SSH Tectia Authentication Bypass Remote Zeroday Exploit

Source: FULLDISC
Type: UNKNOWN
20121203 Re: SSH.com Communications SSH Tectia Authentication Bypass Remote Zeroday Exploit (king cope)

Source: MITRE
Type: CNA
CVE-2012-5975

Source: CCN
Type: Packet Storm Security [12-02-2012]
Tectia SSH USERAUTH Change Request Password Reset

Source: CCN
Type: SA51456
SSH Tectia Server Authentication Security Bypass Vulnerability

Source: EXPLOIT-DB
Type: UNKNOWN
23082

Source: CCN
Type: BID-56783
SSH Tectia Server Unauthorized Password Change Security Bypass Vulnerability

Source: CCN
Type: SSH Communications Security Advisory Web Site
SSH Communications Security Advisory

Source: CCN
Type: SSH Communications Security Web site
SSH : Support : Downloads

Source: XF
Type: UNKNOWN
ssh-tectia-security-bypass(80454)

Source: MISC
Type: Exploit
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/ssh/tectia_passwd_changereq.rb

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [12-02-2012]

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [12-05-2012]

Source: CCN
Type: Rapid7 Vulnerability and Exploit Database [05-30-2018]
Tectia SSH USERAUTH Change Request Password Reset Vulnerability

Vulnerable Configuration:Configuration 1:
  • cpe:/a:ssh:tectia_server:6.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.0.10:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.0.11:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.0.12:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.0.13:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.0.14:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.0.17:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.0.18:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.0.19:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.0.20:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.1.5:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.1.6:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.1.7:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.1.8:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.1.9:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.1.12:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.2.4:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.2.5:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:ssh:tectia_server:6.3.2:*:*:*:*:*:*:*
  • AND
  • cpe:/o:linux:linux_kernel:*:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:ssh:tectia_server:6.1.9.95:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    ssh tectia server 6.0.4
    ssh tectia server 6.0.5
    ssh tectia server 6.0.6
    ssh tectia server 6.0.7
    ssh tectia server 6.0.8
    ssh tectia server 6.0.9
    ssh tectia server 6.0.10
    ssh tectia server 6.0.11
    ssh tectia server 6.0.12
    ssh tectia server 6.0.13
    ssh tectia server 6.0.14
    ssh tectia server 6.0.17
    ssh tectia server 6.0.18
    ssh tectia server 6.0.19
    ssh tectia server 6.0.20.
    ssh tectia server 6.1.0
    ssh tectia server 6.1.1
    ssh tectia server 6.1.2
    ssh tectia server 6.1.3
    ssh tectia server 6.1.4
    ssh tectia server 6.1.5
    ssh tectia server 6.1.6
    ssh tectia server 6.1.7
    ssh tectia server 6.1.8
    ssh tectia server 6.1.9
    ssh tectia server 6.1.12
    ssh tectia server 6.2.0
    ssh tectia server 6.2.1
    ssh tectia server 6.2.2
    ssh tectia server 6.2.3
    ssh tectia server 6.2.4
    ssh tectia server 6.2.5
    ssh tectia server 6.3.0
    ssh tectia server 6.3.1
    ssh tectia server 6.3.2
    linux linux kernel *
    ssh tectia server 6.1.9.95