Description
Format string vulnerability in the log function in Georgia SoftWorks SSH2 Server (GSW_SSHD) 7.01.0003 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the username field, as demonstrated by a certain LoginPassword message.
References
- 3517 third-party-advisory
- http://aluigi.altervista.org/adv/gswsshit-adv.txt
- 20080102 Multiple vulnerabilities in Georgia SoftWorks SSH2 Server 7.01.0003 mailing-list
- 28307 third-party-advisory