CVE-2012-10060

Sysax Multi Server versions prior to 5.55 contains a stack-based buffer overflow in its SSH service. When a remote attacker supplies an overly long username during authentication, the server copies the input to a fixed-size stack buffer without proper bounds checking. This allows remote code execution under the context of the service.

CVSS

No CVSS.

References

Link	Resource
https://advisories.checkpoint.com/defense/advisories/public/2012/cpai-23-sepc.html
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ssh/sysax_ssh_username.rb
https://web.archive.org/web/20120302203344/http://www.pwnag3.com/2012/02/sysax-multi-server-ssh-username-exploit.html
https://www.exploit-db.com/exploits/18535
https://www.exploit-db.com/exploits/18557
https://www.sysax.com/
https://www.vulncheck.com/advisories/sysax-multi-server-ssh-username-buffer-overflow
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ssh/sysax_ssh_username.rb

Configurations

No configuration.

History

14 Aug 2025, 15:15

Type	Values Removed	Values Added
References	~~() https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ssh/sysax_ssh_username.rb -~~	() https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ssh/sysax_ssh_username.rb -

14 Aug 2025, 13:11

Type	Values Removed	Values Added
Summary		(es) Las versiones de Sysax Multi Server anteriores a la 5.55 presentan un desbordamiento de búfer basado en la pila en su servicio SSH. Cuando un atacante remoto proporciona un nombre de usuario demasiado largo durante la autenticación, el servidor copia la entrada a un búfer de pila de tamaño fijo sin la comprobación adecuada de los límites. Esto permite la ejecución remota de código en el contexto del servicio.

13 Aug 2025, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-13 21:15

Updated : 2025-08-14 15:15

NVD link : CVE-2012-10060

Mitre link : CVE-2012-10060

CVE.ORG link : CVE-2012-10060

JSON object : View

Products Affected

No product.

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2012-10060", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-08-13T21:15:30.600", "references": [{"url": "https://advisories.checkpoint.com/defense/advisories/public/2012/cpai-23-sepc.html", "source": "disclosure@vulncheck.com"}, {"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ssh/sysax_ssh_username.rb", "source": "disclosure@vulncheck.com"}, {"url": "https://web.archive.org/web/20120302203344/http://www.pwnag3.com/2012/02/sysax-multi-server-ssh-username-exploit.html", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/18535", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/18557", "source": "disclosure@vulncheck.com"}, {"url": "https://www.sysax.com/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/sysax-multi-server-ssh-username-buffer-overflow", "source": "disclosure@vulncheck.com"}, {"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ssh/sysax_ssh_username.rb", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "Sysax Multi Server versions prior to 5.55 contains a stack-based buffer overflow in its SSH service. When a remote attacker supplies an overly long username during authentication, the server copies the input to a fixed-size stack buffer without proper bounds checking. This allows remote code execution under the context of the service."}, {"lang": "es", "value": "Las versiones de Sysax Multi Server anteriores a la 5.55 presentan un desbordamiento de b\u00fafer basado en la pila en su servicio SSH. Cuando un atacante remoto proporciona un nombre de usuario demasiado largo durante la autenticaci\u00f3n, el servidor copia la entrada a un b\u00fafer de pila de tama\u00f1o fijo sin la comprobaci\u00f3n adecuada de los l\u00edmites. Esto permite la ejecuci\u00f3n remota de c\u00f3digo en el contexto del servicio."}], "lastModified": "2025-08-14T15:15:31.313", "sourceIdentifier": "disclosure@vulncheck.com"}