The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator (PRNG), which causes the state to be shared between children processes and allows local users to obtain sensitive information by leveraging a pid collision.

New libssh packages are available for Slackware 14.0, 14.1, and
-current to fix security issues.

Updated libssh packages fix security vulnerabilities :

When using libssh before 0.6.3, a libssh-based server, when accepting a new connection, forks and the child process handles the request. The RAND_bytes() function of openssl doesn't reset its state after the fork, but simply adds the current process id (getpid) to the PRNG state, which is not guaranteed to be unique. The most important consequence is that servers using EC (ECDSA) or DSA certificates may under certain conditions leak their private key (CVE-2014-0017).

Double free vulnerability in the ssh_packet_kexinit function in kex.c in libssh 0.5.x and 0.6.x before 0.6.4 allows remote attackers to cause a denial of service via a crafted kexinit packet (CVE-2014-8132).

Aris Adamantiadis reports :

When accepting a new connection, the server forks and the child process handles the request. The RAND_bytes() function of openssl doesn't reset its state after the fork, but simply adds the current process id (getpid) to the PRNG state, which is not guaranteed to be unique.

The remote host is affected by the vulnerability described in GLSA-201408-03 (LibSSH: Information disclosure)

    A new connection inherits the state of the PRNG without re-seeding with       random data.
  Impact :

    Servers using ECC (ECDSA) or DSA certificates in non-deterministic mode       may under certain conditions leak their private key.
  Workaround :

    There is no known workaround at this time.

libssh was updated to fix a random generator reseeding issue when forking multiple servers. Forking multiple servers might under some circumstances get them the same random seed state.

This update of libssh fixes the following security issue :

  - When libssh operates in server mode, the randomness pool     was not switched on fork, so two pools could operate on     the same randomness and could generate the same keys.

Fix CVE-2014-0017.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated libssh package fixes security vulnerability :

When using libssh before 0.6.3, a libssh-based server, when accepting a new connection, forks and the child process handles the request. The RAND_bytes() function of openssl doesn't reset its state after the fork, but simply adds the current process id (getpid) to the PRNG state, which is not guaranteed to be unique. The most important consequence is that servers using EC (ECDSA) or DSA certificates may under certain conditions leak their private key (CVE-2014-0017).

It was discovered that libssh, a tiny C SSH library, did not reset the state of the PRNG after accepting a connection. A server mode application that forks itself to handle incoming connections could see its children sharing the same PRNG state, resulting in a cryptographic weakness and possibly the recovery of the private key.

Aris Adamantiadis discovered that libssh allowed the OpenSSL PRNG state to be reused when implementing forking servers. This could allow an attacker to possibly obtain information about the state of the PRNG and perform cryptographic attacks.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
82917	Slackware 14.0 / 14.1 / current : libssh (SSA:2015-111-04)	Nessus	Slackware Local Security Checks	medium
82339	Mandriva Linux Security Advisory : libssh (MDVSA-2015:086)	Nessus	Mandriva Local Security Checks	medium
78730	FreeBSD : libssh -- PRNG state reuse on forking servers (f8c88d50-5fb3-11e4-81bd-5453ed2e2b49)	Nessus	FreeBSD Local Security Checks	low
77112	GLSA-201408-03 : LibSSH: Information disclosure	Nessus	Gentoo Local Security Checks	low
75290	openSUSE Security Update : libssh (openSUSE-SU-2014:0366-1)	Nessus	SuSE Local Security Checks	low
73130	SuSE 11.3 Security Update : libssh2 (SAT Patch Number 8982)	Nessus	SuSE Local Security Checks	low
73037	Fedora 19 : libssh-0.6.3-1.fc19 (2014-3485)	Nessus	Fedora Local Security Checks	low
73000	Mandriva Linux Security Advisory : libssh (MDVSA-2014:053)	Nessus	Mandriva Local Security Checks	low
72994	Debian DSA-2879-1 : libssh - security update	Nessus	Debian Local Security Checks	low
72980	Ubuntu 12.04 LTS / 12.10 / 13.10 : libssh vulnerability (USN-2145-1)	Nessus	Ubuntu Local Security Checks	low
72871	Fedora 20 : libssh-0.6.3-1.fc20 (2014-3473)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2014-0017

critical

Tenable Plugins

medium

medium

low

low

low

low

low

low

low

low

low