|
|
Family: Misc. --> Category: infos
AttachmateWRQ Reflection for Secure IT Server < 6.0 Build 24 Multiple Vulnerabilities Vulnerability Scan
Vulnerability Scan Summary
Checks for multiple vulnerabilities in AttachmateWRQ Reflection for Secure IT Server < 6.0 build 24
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote SSH server is affected by multiple vulnerabilities.
Description :
The remote host is running AttachmateWRQ Reflection for Secure IT
Server, a commercial SSH server for Windows.
According to its banner, the installed version of Reflection for
Secure IT Server on the remote host suffers from several
vulnerabilities, including :
- An Access Restriction Bypass Vulnerability
Access expressions are evaluated in a case-sensitive
manner while in versions prior to 6.0 they were case-
insensitive. This may let a possible hacker gain access
to an otherwise restricted account by logging in
using a variation on the account name.
- A Renamed Account Remote Login Vulnerability
The application continues to accept valid public keys
for authentication to the the Administrator or Guest
accounts if either has been renamed or disabled after
being configured for SSH public key authentication,
- An Information Disclosure Vulnerability
Users with access to the remote host can read the server's
private key, which can lead to host impersonation attacks.
See also :
http://support.wrq.com/techdocs/1867.html
Solution :
Upgrade to Reflection for Secure IT Server 6.0 build 24 or later.
Threat Level:
Low / CVSS Base Score : 3
(AV:R/AC:H/Au:R/C:P/A:P/I:P/B:N)
Click HERE for more information and discussions on this network vulnerability scan.
|
