CVE-2019-25607 - Vulnerability Analysis

Overview

Axessh 4.2 contains a stack-based buffer overflow caused by an excessively long log file name, letting local attackers execute arbitrary code with system privileges, exploit requires local access.

Severity & Score

Impact

Local attackers can execute arbitrary code with system privileges, leading to full system compromise.

Mitigation

Update to the latest version.

References

• http://www.labf.com
• http://www.labf.com/download/axessh.exe
• https://www.exploit-db.com/exploits/46858
• https://www.exploit-db.com/exploits/46922
• https://www.exploit-db.com/shellcodes/46281
• https://www.vulncheck.com/advisories/axessh-local-stack-based-buffer-overflow-via-log-file-name

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner