Axessh Denial-of-Service Vulnerability in Logging Configuration

A denial-of-service vulnerability has been identified in Axessh version 4.2. This issue arises from the logging configuration, where local attackers can cause the application to crash by entering an excessively long string in the log file name field. The vulnerability can be exploited by enabling session logging, pasting a buffer of 500 or more characters into the log file name parameter, and then establishing a telnet connection, which triggers the application crash.

Impact

Exploitation of this vulnerability leads to a crash of the Axessh application, causing a denial-of-service condition.

Reproduction

To reproduce this vulnerability, first enable session logging in the Axessh application. Then, paste a buffer of 500 or more characters into the log file name parameter. After setting the log file name, proceed to establish a telnet connection, which will cause the application to crash.