Executive brief
Sysax Multi Server, a multi-protocol file transfer and remote access server, contains a critical security flaw in its SSH service. An unauthenticated remote attacker can exploit this by sending a specially crafted, overly long username during the login process. Successful exploitation allows the attacker to take full control of the server, potentially leading to data theft, service disruption, or further network intrusion.
Technical details
A stack-based buffer overflow exists in the SSH authentication component of Sysax Multi Server (versions < 5.55). The vulnerability is caused by a lack of bounds checking when copying a user-supplied username into a fixed-size stack buffer. An unauthenticated remote attacker can trigger this overflow by providing an excessively long username (approximately 10,000 bytes) during the SSH handshake. This leads to a Structured Exception Handler (SEH) overwrite on Windows platforms, enabling arbitrary code execution under the context of the Sysax service. Public exploit modules, including Metasploit, are available for this vulnerability.
Affected products
- Sysax Multi Server prior to 5.55
Timeline
- 2012-02-22: other: Vulnerability discovered
- 2012-02-27: disclosed: Public disclosure and exploit release
- 2012-02-27: patched: Vendor released version 5.55 to address the issue
- 2025-08-13: advisory: CVE-2012-10060 published/updated in NVD
References
- https://advisories.checkpoint.com/defense/advisories/public/2012/cpai-23-sepc.html
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ssh/sysax_ssh_username.rb
- https://web.archive.org/web/20120302203344/http://www.pwnag3.com/2012/02/sysax-multi-server-ssh-username-exploit.html
- https://www.exploit-db.com/exploits/18535
- https://www.exploit-db.com/exploits/18557
- https://www.sysax.com/
- https://www.vulncheck.com/advisories/sysax-multi-server-ssh-username-buffer-overflow