CyberSec.Space Logo
Back to CVE Browser

CVE-2020-12651

CRITICAL
9.8
CVSS Severity Score
EPSS Score0.1360%
EPSS Percentile12.94th
PublishedMay 15, 2020
Last ModifiedNov 21, 2024

Vulnerability Description

SecureCRT before 8.7.2 allows remote attackers to execute arbitrary code via an Integer Overflow and a Buffer Overflow because a banner can trigger a line number to CSI functions that exceeds INT_MAX.

Affected Platforms (CPE)

📦
Vandyke

Securecrt

< 8.7.2
📦
Vandyke

Securecrt

< 2.4

References & Advisories

🔗 https://bugs.chromium.org/p/project-zero/issues/detail?id=2033
🔗 https://twitter.com/taviso/status/1261079774190919680
🔗 https://www.vandyke.com/products/securecrt/history.txt
🔗 https://www.vandyke.com/support/advisory/index.html
🔗 https://bugs.chromium.org/p/project-zero/issues/detail?id=2033
🔗 https://twitter.com/taviso/status/1261079774190919680
🔗 https://www.vandyke.com/products/securecrt/history.txt
🔗 https://www.vandyke.com/support/advisory/index.html

Related Vulnerabilities

CVE-2006-103810.0

Buffer overflow in SecureCRT 5.0.4 and earlier and SecureFX 3.0.4 and earlier allows remote attackers to have an unknown impact wh...

CVE-2001-14667.5

Buffer overflow in VanDyke SecureCRT before 3.4.2, when using the SSH-1 protocol, allows remote attackers to execute arbitrary cod...

CVE-2002-10597.5

Buffer overflow in Van Dyke SecureCRT SSH client before 3.4.6, and 4.x before 4.0 beta 3, allows an SSH server to execute arbitrar...

CVE-2004-15417.5

SecureCRT 4.0, 4.1, and possibly other versions, allows remote attackers to execute arbitrary commands via a telnet:// URL that us...