KLA11448 DoS vulnerability in WinSCP

2013-08-1900:00:00

Kaspersky Lab

threats.kaspersky.com

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.7 High

AI Score

Confidence

Low

0.027 Low

EPSS

Percentile

90.6%

JSON

Integer overflow vulnerability was found in WinSCP. Malicious users can exploit this vulnerability remotely to cause denial of service and possibly execute arbitrary code.

Original advisories

[http://winscp.net/tracker/show_bug.cgi?id=1017](Bug 1017 – SSH vulnerability)

Related products

WinSCP

CVE list

CVE-2013-4852 high

Solution

Update to the latest version

Download WinSCP

Impacts

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.