Multiple integer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (infinite loop or crash) and possibly execute arbitrary code via unspecified vectors, which triggers a buffer overflow, infinite loop, or possibly some other unspecified vulnerabilities.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Multiple double free vulnerabilities in the (1) agent_sign_data function in agent.c, (2) channel_request
    function in channels.c, (3) ssh_userauth_pubkey function in auth.c, (4) sftp_parse_attr_3 function in
    sftp.c, and (5) try_publickey_from_file function in keyfiles.c in libssh before 0.5.3 allow remote
    attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified
    vectors. (CVE-2012-4559)

  - The (1) publickey_make_dss, (2) publickey_make_rsa, (3) signature_from_string, (4) ssh_do_sign, and (5)
    ssh_sign_session_id functions in keys.c in libssh before 0.5.3 free "an invalid pointer on an error path,"
    which might allow remote attackers to cause a denial of service (crash) via unspecified vectors.
    (CVE-2012-4561)

  - Multiple integer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service
    (infinite loop or crash) and possibly execute arbitrary code via unspecified vectors, which triggers a
    buffer overflow, infinite loop, or possibly some other unspecified vulnerabilities. (CVE-2012-4562)

This update of libssh fixed various memory management issues that could have security implications (Code execution, Denial of Service).

The remote host is affected by the vulnerability described in GLSA-201402-26 (libssh: Arbitrary code execution)

    Multiple buffer overflow, double free, and integer overflow       vulnerabilities have been discovered in libssh.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Updated libssh packages fix security vulnerabilities :

Multiple double free flaws, buffer overflow flaws, invalid free flaws, and improper overflow checks in libssh before 0.5.3 could enable a denial of service attack against libssh clients, or possibly arbitrary code execution (CVE-2012-4559, CVE-2012-4560, CVE-2012-4561 and CVE-2012-4562).

Yong Chuan Koh discovered that libssh incorrectly handled certain negotiation requests. A remote attacker could use this to cause libssh to crash, resulting in a denial of service (CVE-2013-0176).

This update of libssh fixes multiple integer overflows. CVE-2012-4562 has been assigned to this issue.

This is an important SECURITY and maintenance release in order to address CVE-2012-4559, CVE-2012-4560, CVE-2012-4561 and CVE-2012-4562.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New libssh packages are available for Slackware 14.0, and -current to fix security issues.

Multiple vulnerabilities were discovered in libssh by Florian Weimer and Xi Wang :

  - CVE-2012-4559: multiple double free() flaws
  - CVE-2012-4561: multiple invalid free() flaws
  - CVE-2012-4562: multiple improper overflow checks

Those could lead to a denial of service by making an SSH client linked to libssh crash, and maybe even arbitrary code execution.

Multiple double free(), buffer overflow, invalid free() and improper overflow checks vulnerabilities was found and corrected in libssh (CVE-2012-4559, CVE-2012-4560, CVE-2012-4561, CVE-2012-4562).

The updated packages have been upgraded to the 0.5.3 version which is not affected by these issues.

Xi Wang and Florian Weimer discovered that libssh incorrectly handled memory. A remote attacker could use this to cause libssh to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2012-4559, CVE-2012-4560, CVE-2012-4561, CVE-2012-4562).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
401323	Alpine: multiple libssh packages: security update to 0.5.2-r1 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
401323	Alpine: multiple libssh packages: security update to 0.5.2-r1 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
74834	openSUSE Security Update : libssh (openSUSE-SU-2012:1620-1)	Nessus	SuSE Local Security Checks	Local	high
74829	openSUSE Security Update : libssh (openSUSE-SU-2012:1622-1)	Nessus	SuSE Local Security Checks	Local	high
72640	GLSA-201402-26 : libssh: Arbitrary code execution	Nessus	Gentoo Local Security Checks	Local	high
66059	Mandriva Linux Security Advisory : libssh (MDVSA-2013:045)	Nessus	Mandriva Local Security Checks	Local	high
64196	SuSE 11.2 Security Update : libssh2 (SAT Patch Number 7073)	Nessus	SuSE Local Security Checks	Local	high
63173	Fedora 16 : libssh-0.5.3-1.fc16 (2012-18687)	Nessus	Fedora Local Security Checks	Local	high
63168	Slackware 14.0 / current : libssh (SSA:2012-341-02)	Nessus	Slackware Local Security Checks	Local	high
63125	Debian DSA-2577-1 : libssh - several vulnerabilities	Nessus	Debian Local Security Checks	Local	high
63104	Mandriva Linux Security Advisory : libssh (MDVSA-2012:175)	Nessus	Mandriva Local Security Checks	Local	high
63089	Fedora 17 : libssh-0.5.3-1.fc17 (2012-18677)	Nessus	Fedora Local Security Checks	Local	high
63058	Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : libssh vulnerabilities (USN-1640-1)	Nessus	Ubuntu Local Security Checks	Local	high
63054	Fedora 18 : libssh-0.5.3-1.fc18 (2012-18610)	Nessus	Fedora Local Security Checks	Local	high

Detections

Analytics

CVE-2012-4562

high

Tenable Plugins

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high