Unquoted Windows search path vulnerability in multiple SSH Tectia products, including Client/Server/Connector 5.0.0 and 5.0.1 and Client/Server before 4.4.5, and Manager 2.12 and earlier, when running on Windows, might allow local users to gain privileges via a malicious program file under Program Files or its subdirectories.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Tectia_client | Ssh | 4.0 (including) | 4.0 (including) |
| Tectia_client | Ssh | 4.0.1 (including) | 4.0.1 (including) |
| Tectia_client | Ssh | 4.0.3 (including) | 4.0.3 (including) |
| Tectia_client | Ssh | 4.0.4 (including) | 4.0.4 (including) |
| Tectia_client | Ssh | 4.0.5 (including) | 4.0.5 (including) |
| Tectia_client | Ssh | 4.2 (including) | 4.2 (including) |
| Tectia_client | Ssh | 4.2.1 (including) | 4.2.1 (including) |
| Tectia_client | Ssh | 4.3 (including) | 4.3 (including) |
| Tectia_client | Ssh | 4.3.1 (including) | 4.3.1 (including) |
| Tectia_client | Ssh | 4.3.1j (including) | 4.3.1j (including) |
| Tectia_client | Ssh | 4.3.2 (including) | 4.3.2 (including) |
| Tectia_client | Ssh | 4.3.3 (including) | 4.3.3 (including) |
| Tectia_client | Ssh | 4.3.4 (including) | 4.3.4 (including) |
| Tectia_client | Ssh | 4.3.5 (including) | 4.3.5 (including) |
| Tectia_client | Ssh | 4.3.6 (including) | 4.3.6 (including) |
| Tectia_client | Ssh | 4.3.7 (including) | 4.3.7 (including) |
| Tectia_client | Ssh | 4.3.8k (including) | 4.3.8k (including) |
| Tectia_client | Ssh | 4.4 (including) | 4.4 (including) |
| Tectia_client | Ssh | 4.4.1 (including) | 4.4.1 (including) |
| Tectia_client | Ssh | 4.4.2 (including) | 4.4.2 (including) |
| Tectia_client | Ssh | 4.4.3 (including) | 4.4.3 (including) |
| Tectia_client | Ssh | 4.4.4 (including) | 4.4.4 (including) |
| Tectia_client | Ssh | 4.4.5 (including) | 4.4.5 (including) |
| Tectia_client | Ssh | 5.0 (including) | 5.0 (including) |
| Tectia_client | Ssh | 5.0.1 (including) | 5.0.1 (including) |
| Tectia_connector | Ssh | 5.0 (including) | 5.0 (including) |
| Tectia_connector | Ssh | 5.0.1 (including) | 5.0.1 (including) |
| Tectia_manager | Ssh | 1.3 (including) | 1.3 (including) |
| Tectia_manager | Ssh | 1.4 (including) | 1.4 (including) |
| Tectia_manager | Ssh | 2.1.2 (including) | 2.1.2 (including) |
| Tectia_server | Ssh | 4.0 (including) | 4.0 (including) |
| Tectia_server | Ssh | 4.0.3 (including) | 4.0.3 (including) |
| Tectia_server | Ssh | 4.0.4 (including) | 4.0.4 (including) |
| Tectia_server | Ssh | 4.0.5 (including) | 4.0.5 (including) |
| Tectia_server | Ssh | 4.2.1 (including) | 4.2.1 (including) |
| Tectia_server | Ssh | 4.3 (including) | 4.3 (including) |
| Tectia_server | Ssh | 4.3.1 (including) | 4.3.1 (including) |
| Tectia_server | Ssh | 4.3.2 (including) | 4.3.2 (including) |
| Tectia_server | Ssh | 4.3.3 (including) | 4.3.3 (including) |
| Tectia_server | Ssh | 4.3.4 (including) | 4.3.4 (including) |
| Tectia_server | Ssh | 4.3.5 (including) | 4.3.5 (including) |
| Tectia_server | Ssh | 4.3.6 (including) | 4.3.6 (including) |
| Tectia_server | Ssh | 4.3.7 (including) | 4.3.7 (including) |
| Tectia_server | Ssh | 4.4 (including) | 4.4 (including) |
| Tectia_server | Ssh | 4.4.2 (including) | 4.4.2 (including) |
| Tectia_server | Ssh | 4.4.3 (including) | 4.4.3 (including) |
| Tectia_server | Ssh | 4.4.4 (including) | 4.4.4 (including) |
| Tectia_server | Ssh | 4.4.5 (including) | 4.4.5 (including) |
| Tectia_server | Ssh | 5.0 (including) | 5.0 (including) |
| Tectia_server | Ssh | 5.0.1 (including) | 5.0.1 (including) |
References
- http://securitytracker.com/id?1016743
- http://www.securityfocus.com/bid/19679
- http://www.ssh.com/company/news/2006/english/security/article/775/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/28566
- http://securitytracker.com/id?1016743
- http://www.securityfocus.com/bid/19679
- http://www.ssh.com/company/news/2006/english/security/article/775/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/28566