A vulnerability has been identified in LSH, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to a boundary error in "read_line.c" when checking for errors. This can be exploited to cause a heap overflow by sending an overly long, specially crafted string.

Successful exploitation allows execution of arbitrary code on the vulnerable system and doesn't require user authentication.

An exploit has been published.

NOTE: Reportedly, similar bugs were also identified in the check for channel number allocation and in the experimental client SRP code.

Solution
Apply patch for 1.4.2, or update to version 1.4.3 or 1.5.3.
Further details available to Secunia VIM customers

Provided and/or discovered by
Bennett Todd

Original Advisory
http://lists.lysator.liu.se/pipermail/lsh-bugs/2003q3/000127.html

Deep Links
Links available to Secunia VIM customers