C-Kermit versions from 7.0.197 up to but not including 11.1.515 contain an authentication bypass vulnerability in the IKSD SSL build. This flaw allows attackers with a trusted certificate mapped to a refused account to bypass authentication and gain shell access to any other account by exploiting the Telnet authentication state remaining at AUTH_VALID after a refused certificate login. The vulnerability is fixed in version 11.1.515.
C-Kermit versions from 8.0.200 up to but not including 11.1.515 have a vulnerability in SSL certificate validation that allows attackers to impersonate Telnet servers. This occurs because the ssl_reply() function does not verify the server's hostname against the certificate, enabling man-in-the-middle attacks. Attackers can refuse START-TLS, offer Telnet AUTHENTICATION SSL, and present any trusted CA certificate to capture user credentials and session data. The issue is fixed in version 11.1.515.
C-Kermit versions from 8.0.200 up to but not including 11.1.515 contain a vulnerability in certificate hostname validation. This flaw allows attackers with a trusted certificate containing wildcard characters to impersonate hosts by exploiting improper matching logic in the dNSName_cmp() function. Successful exploitation could lead to interception of credentials and data over TLS connections used by Telnet, FTP, and HTTP protocols. The vulnerability is rated high severity with a CVSS 4.0 score of 7.6. A fix is available in version 11.1.515.
C-Kermit versions from 6.0.192 up to but not including 11.1.515 contain an authorization bypass vulnerability that allows malicious senders to append data to existing files by exploiting a file collision protection bypass. This occurs because the gattr() function clears the REJECT discard flag and switches to APPEND mode without user confirmation, enabling unauthorized modification of files such as shell startup scripts.
C-Kermit versions 11.0.506 up to but not including 11.1.515 contain a vulnerability in the RECEIVE CONFIRM feature that allows malicious Kermit servers to write files without user confirmation. This occurs due to improper authorization checks in recursive GET root computation, enabling attackers to write sensitive files like .ssh/authorized_keys or shell startup files silently. This can lead to persistent unauthorized access or code execution. The issue is fixed in version 11.1.515.
C-Kermit versions from 8.0.200 up to but not including 11.1.515 contain a path traversal vulnerability in the doftpget() function. This flaw allows malicious FTP servers to write files outside the intended directory by returning crafted paths during recursive FTP get operations. Exploitation can lead to overwriting critical files such as .bashrc, potentially enabling code execution.
C-Kermit versions from 6.0.192 up to but not including 11.1.515 contain a buffer overflow vulnerability in the tn_snenv() function. This flaw allows malicious Telnet servers to corrupt client memory by sending crafted NEW-ENVIRON SEND subnegotiation messages with oversized variable names before authentication. The vulnerability involves overflowing a 16-byte stack buffer and a miscalculated heap buffer, leading to stack and heap memory corruption. A fix is available in version 11.1.515.
C-Kermit versions 8.0.200 up to but not including 11.1.515 contain a buffer overflow vulnerability in the getreply() function within ckcftp.c. This flaw allows malicious FTP servers to send overly long security replies, such as PBSZ replies after AUTH TLS or ADAT replies in certain authentication builds, which can overwrite client memory. The vulnerability is fixed in version 11.1.515.
C-Kermit versions before 11.1.515 contain a critical OS command injection vulnerability. Remote clients can exploit this flaw by supplying unquoted arguments to the REMOTE WHO or REMOTE SPACE commands, allowing execution of arbitrary shell commands on the server. This occurs even if the DISABLE HOST setting is enabled. The vulnerability is fixed in version 11.1.515.
C-Kermit versions from 6.0.192 up to but not including 11.1.515 contain a critical remote code execution vulnerability. This flaw allows attackers to execute shell commands on servers even when host commands are disabled by abusing REMOTE QUERY evaluation. The vulnerability can be exploited by sending a REMOTE QUERY that invokes the command function or by defining and executing a macro via REMOTE ASSIGN, bypassing restrictions such as nopush and DISABLE HOST. A fix is available in version 11.1.515.
C-Kermit versions before 11.1.515 contain a heap-based buffer overflow vulnerability in the putsrv() function within ckcfns.c. This flaw allows malicious peers to write beyond the allocated srvcmd buffer by sending specially crafted packets using Kermit repeat-count compression. The vulnerability affects server commands, GET, or file-header packets, potentially leading to memory corruption on servers or receiving instances. A fix is available in version 11.1.515.