Description
A denial-of-service vulnerability exists in Sysax Multi-Server version 6.10 via its SSH daemon. A specially crafted SSH key exchange packet can trigger a crash in the service, resulting in loss of availability. The flaw is triggered during the handling of malformed key exchange data, including a non-standard byte (\x28) in place of the expected SSH protocol delimiter.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Sysax Software Multi-Server
Default version status: unknown
6.10affected
References
- https://www.mattandreko.com/2013/04/08/sysax-multi-server-6.10-ssh-dos/ ↗
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/dos/windows/ssh/sysax_sshd_kexchange.rb ↗
- https://www.sysax.com/ ↗
- https://www.vulncheck.com/advisories/sysax-multi-server-sshd-key-exchange-dos ↗