AbsoluteTelnet Denial-of-Service Vulnerability in SSH2 Username Input

A denial-of-service vulnerability has been identified in AbsoluteTelnet version 11.12. The issue resides in the SSH2 username input field, where local attackers can crash the application by overwriting the username with a 1000-byte buffer. This action causes the application to become unresponsive and terminate.

Impact

Exploitation of this vulnerability leads to a crash of the AbsoluteTelnet application, causing it to become unresponsive and terminate prematurely.

Reproduction

To reproduce this vulnerability, first run a Python script that generates a 1000-byte buffer and saves it to a text file. Then, open AbsoluteTelnet and create a new connection file, selecting the SSH2 protocol and the option to use the last username. Paste the buffered content into the username field and confirm. This action will cause the application to crash.