The CLI interface for WatchGuard Firebox Vclass 3.2 and earlier, and RSSA Appliance 3.0.2, does not properly close the SSH connection when a -N option is provided during authentication, which allows remote attackers to access CLI with administrator privileges.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Rapidstream | Rapidstream | 500 (including) | 500 (including) |
| Rapidstream | Rapidstream | 2000 (including) | 2000 (including) |
| Rapidstream | Rapidstream | 4000 (including) | 4000 (including) |
| Rapidstream | Rapidstream | 6000 (including) | 6000 (including) |
| Rapidstream | Rapidstream | 8000 (including) | 8000 (including) |
| Firebox | Watchguard | v10 (including) | v10 (including) |
| Firebox | Watchguard | v60 (including) | v60 (including) |
| Firebox | Watchguard | v80 (including) | v80 (including) |
| Firebox | Watchguard | v100 (including) | v100 (including) |
References
- http://archives.neohapsis.com/archives/bugtraq/2002-09/0325.html
- http://archives.neohapsis.com/archives/bugtraq/2002-09/0335.html
- http://www.iss.net/security_center/static/10218.php
- http://www.osvdb.org/4831
- http://www.securityfocus.com/bid/5815
- http://archives.neohapsis.com/archives/bugtraq/2002-09/0325.html
- http://archives.neohapsis.com/archives/bugtraq/2002-09/0335.html
- http://www.iss.net/security_center/static/10218.php
- http://www.osvdb.org/4831
- http://www.securityfocus.com/bid/5815