{"vuid":"VU#477960","idnumber":"477960","name":"WeOnlyDo! Software wodSSHServer ActiveX component fails to properly validate key exchange algorithm strings","keywords":["FreeSSHd","wodSSHServer","Denial of Service","DoS","buffer overflow","arbitrary code execution","key exchange algorithm","SSH client"],"overview":"The WeOnlyDo! Software wodSSHServer ActiveX component fails to properly validate the length of key exchange algorithm strings. This may allow a remote, unauthenticated attacker to execute arbitrary code.","clean_desc":"wodSSHServer ActiveX component According to the wodSSHServer ActiveX component  website: wodSSHServer is an SSH Server ActiveX component (but also Telnet Server ActiveX as well) that will give you ability to easily add SSH2 (and SFTP) server capabilities to your application, as well as old TELNET server protocol. The Problem wodSSHServer does not validate key exchange algorithm strings supplied by a client. If a client sends a specially crafted key exchange algorithm string to a vulnerable wodSSHServer installation, that attacker may be able to trigger the overflow. Any application that uses the wodSSHServer ActiveX Component may be affected by this vulnerability. Known instances of this are freeSSHd and freeFTPd, but there may be others. Note that working exploit code for this vulnerability is publicly available.","impact":"A remote attacker may be able to execute arbitrary code on the server using the wodSSHServer ActiveX component. If that server is running with administrative privileges, the attacker could gain complete control of the system.","resolution":"Upgrade\nThis issue is addressed in wodSSHServer ActiveX component version 1.3.4, freeSSHd version 1.0.10, and freeFTPd version 1.0.11.","workarounds":"","sysaffected":"","thanks":"This issue was reported by \nGerry Eisenhaur.","author":"This document was written by Jeff Gennari.","public":["http://secunia.com/advisories/19846/","http://secunia.com/advisories/19845/","http://www.weonlydo.com/index.asp?showform=SSHServer&rnotes=1","http://freesshd.com/","http://www.freeftpd.com/"],"cveids":["CVE-2006-2407"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2006-05-13T17:35:24Z","publicdate":"2006-05-12T00:00:00Z","datefirstpublished":"2006-05-18T20:10:36Z","dateupdated":"2006-05-18T21:49:45Z","revision":30,"vrda_d1_directreport":"0","vrda_d1_population":"2","vrda_d1_impact":"4","cam_widelyknown":"20","cam_exploitation":"10","cam_internetinfrastructure":"0","cam_population":"11","cam_impact":"19","cam_easeofexploitation":"14","cam_attackeraccessrequired":"20","cam_scorecurrent":"32.9175","cam_scorecurrentwidelyknown":"32.9175","cam_scorecurrentwidelyknownexploited":"43.89","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":32.9175,"vulnote":null}