The diffie_hellman_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."

According to the versions of the libssh2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A type confusion issue was found in the way libssh2     generated ephemeral secrets for the     diffie-hellman-group1 and diffie-hellman-group14 key     exchange methods. This would cause an SSHv2     Diffie-Hellman handshake to use significantly less     secure random parameters.(CVE-2016-0787)

  - A flaw was found in the way the kex_agree_methods()     function of libssh2 performed a key exchange when     negotiating a new SSH session. A man-in-the-middle     attacker could use a crafted SSH_MSG_KEXINIT packet to     crash a connecting libssh2 client.(CVE-2015-1782)

  - An integer overflow flaw which could lead to an out of     bounds write was discovered in libssh2 in the way     SSH_MSG_CHANNEL_REQUEST packets with an exit signal are     parsed. A remote attacker who compromises a SSH server     may be able to execute code on the client system when a     user connects to the server.(CVE-2019-3857)

  - An out of bounds read flaw was discovered in libssh2     before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets     with an exit status message and no payload are parsed.
    A remote attacker who compromises a SSH server may be     able to cause a Denial of Service or read data in the     client memory.(CVE-2019-3862)

  - An integer overflow flaw, which could lead to an out of     bounds write, was discovered in libssh2 before 1.8.1 in     the way keyboard prompt requests are parsed. A remote     attacker who compromises a SSH server may be able to     execute code on the client system when a user connects     to the server.(CVE-2019-3856)

  - A flaw was found in libssh2 before 1.8.1. A server     could send a multiple keyboard interactive response     messages whose total length are greater than unsigned     char max characters. This value is used as an index to     copy memory causing in an out of bounds memory write     error.(CVE-2019-3863)

  - An integer overflow flaw which could lead to an out of     bounds write was discovered in libssh2 before 1.8.1 in     the way packets are read from the server. A remote     attacker who compromises a SSH server may be able to     execute code on the client system when a user connects     to the server.(CVE-2019-3855)

  - An out of bounds read flaw was discovered in libssh2     before 1.8.1 when a specially crafted SFTP packet is     received from the server. A remote attacker who     compromises a SSH server may be able to cause a Denial     of Service or read data in the client     memory.(CVE-2019-3858)

  - An out of bounds read flaw was discovered in libssh2     before 1.8.1 in the _libssh2_packet_require and
    _libssh2_packet_requirev functions. A remote attacker     who compromises a SSH server may be able to cause a     Denial of Service or read data in the client     memory.(CVE-2019-3859)

  - An out of bounds read flaw was discovered in libssh2     before 1.8.1 in the way SFTP packets with empty     payloads are parsed. A remote attacker who compromises     a SSH server may be able to cause a Denial of Service     or read data in the client memory.(CVE-2019-3860)

  - An out of bounds read flaw was discovered in libssh2     before 1.8.1 in the way SSH packets with a padding     length value greater than the packet length are parsed.
    A remote attacker who compromises a SSH server may be     able to cause a Denial of Service or read data in the     client memory.(CVE-2019-3861)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libssh2 package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A type confusion issue was found in the way libssh2     generated ephemeral secrets for the     diffie-hellman-group1 and diffie-hellman-group14 key     exchange methods. This would cause an SSHv2     Diffie-Hellman handshake to use significantly less     secure random parameters.(CVE-2016-0787)

  - An integer overflow flaw, which could lead to an out of     bounds write, was discovered in libssh2 before 1.8.1 in     the way keyboard prompt requests are parsed. A remote     attacker who compromises a SSH server may be able to     execute code on the client system when a user connects     to the server.(CVE-2019-3856)

  - A flaw was found in libssh2 before 1.8.1. A server     could send a multiple keyboard interactive response     messages whose total length are greater than unsigned     char max characters. This value is used as an index to     copy memory causing in an out of bounds memory write     error.(CVE-2019-3863)

  - An integer overflow flaw which could lead to an out of     bounds write was discovered in libssh2 before 1.8.1 in     the way packets are read from the server. A remote     attacker who compromises a SSH server may be able to     execute code on the client system when a user connects     to the server.(CVE-2019-3855)

  - An integer overflow flaw which could lead to an out of     bounds write was discovered in libssh2 before 1.8.1 in     the way SSH_MSG_CHANNEL_REQUEST packets with an exit     signal are parsed. A remote attacker who compromises a     SSH server may be able to execute code on the client     system when a user connects to the     server.(CVE-2019-3857)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libssh2 package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A type confusion issue was found in the way libssh2     generated ephemeral secrets for the     diffie-hellman-group1 and diffie-hellman-group14 key     exchange methods. This would cause an SSHv2     Diffie-Hellman handshake to use significantly less     secure random parameters. (CVE-2016-0787)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The diffie_hellman_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a 'bits/bytes confusion bug.' (CVE-2016-0787)

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is prior to 5.4.0. It is, therefore, affected by multiple vulnerabilities :

  - An arbitrary code execution vulnerability exists in the     bundled version of libcurl due to using an insecure path     to look for specific libraries, including the current     working directory, which may not be under user control.
    A remote attacker can exploit this to inject and execute     arbitrary code in the context of the current user.
    (CVE-2016-4802)

  - Multiple flaws exist in the bundled version of libssh     due to a failure to securely generate Diffie-Hellman     secret keys. A man-in-the-middle attacker can exploit     these flaws to intercept and decrypt SSH sessions.
    (CVE-2016-0739, CVE-2016-0787)

  - An integer overflow condition exists in the bundled     version of libcurl due to improper validation of     user-supplied input when handling 'timeval'. An attacker     can exploit this to have an unspecified impact.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201606-12 (libssh and libssh2: Multiple vulnerabilities)

    libssh and libssh2 both have a bits/bytes confusion bug and generate an       abnormaly short ephemeral secret for the diffie-hellman-group1 and       diffie-hellman-group14 key exchange methods. The resulting secret is 128       bits long, instead of the recommended sizes of 1024 and 2048 bits       respectively.
    Additionally, a double free on dangling pointers in initial key exchange       packets within libssh could leave dangling pointers in the session crypto       structures. It is possible to send a malicious kexinit package to       eventually cause a server to do a double-free before this fix. This could       be used for a Denial of Service attack.
  Impact :

    Remote attackers may gain access to confidential information due to the       short keysize generated by libssh and libssh2, or cause a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

A type confusion issue was found in the way libssh2 generated ephemeral secrets for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. This would cause an SSHv2 Diffie-Hellman handshake to use significantly less secure random parameters.

This update for libssh2_org fixes the following issues :

Security issue fixed :

  - CVE-2016-0787 (bsc#967026): Weakness in diffie-hellman     secret key generation lead to much shorter DH groups     then needed, which could be used to retrieve server     keys.

A feature was added :

  - Support of SHA256 digests for DH group exchanges was     added (fate#320343, bsc#961964)

Bug fixed :

  - Properly detect EVP_aes_128_ctr at configure time     (bsc#933336)

This update was imported from the SUSE:SLE-12:Update update project.

This update for libssh2_org fixes the following issues :

  - Add SHA256 support for DH group exchange (fate#320343,     bsc#961964)

  - fix CVE-2016-0787 (bsc#967026)

  - Weakness in diffie-hellman secret key generation lead to     much shorter DH groups then needed, which could be used     to retrieve server keys.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libssh2_org fixes the following issues :

Security issue fixed :

  - CVE-2016-0787 (bsc#967026): Weakness in diffie-hellman     secret key generation lead to much shorter DH groups     then needed, which could be used to retrieve server     keys.

A feature was added :

  - Support of SHA256 digests for DH group exchanges was     added (fate#320343, bsc#961964)

Bug fixed :

  - Properly detect EVP_aes_128_ctr at configure time     (bsc#933336)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A type confusion issue was found in the way libssh2 generated ephemeral secrets for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. This would cause an SSHv2 Diffie-Hellman handshake to use significantly less secure random parameters. (CVE-2016-0787)

After installing these updated packages, all running applications using libssh2 must be restarted for this update to take effect.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - use secrects of the appropriate length in Diffie-Hellman     (CVE-2016-0787)

  - fix basic functionality of libssh2 in FIPS mode     (#968575)

From Red Hat Security Advisory 2016:0428 :

Updated libssh2 packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libssh2 packages provide a library that implements the SSHv2 protocol.

A type confusion issue was found in the way libssh2 generated ephemeral secrets for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. This would cause an SSHv2 Diffie-Hellman handshake to use significantly less secure random parameters. (CVE-2016-0787)

Red Hat would like to thank Aris Adamantiadis for reporting this issue.

All libssh2 users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing these updated packages, all running applications using libssh2 must be restarted for this update to take effect.

Updated libssh2 packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libssh2 packages provide a library that implements the SSHv2 protocol.

A type confusion issue was found in the way libssh2 generated ephemeral secrets for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. This would cause an SSHv2 Diffie-Hellman handshake to use significantly less secure random parameters. (CVE-2016-0787)

Red Hat would like to thank Aris Adamantiadis for reporting this issue.

All libssh2 users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing these updated packages, all running applications using libssh2 must be restarted for this update to take effect.

During the SSHv2 handshake when libssh2 is to get a suitable value for 'group order' in the Diffle Hellman negotiation, it would pass in number of bytes to a function that expected number of bits. This would result in the library generating numbers using only an 8th the number of random bits than what were intended: 128 or 256 bits instead of 1023 or 2047 Using such drastically reduced amount of random bits for Diffie Hellman weakened the handshake security significantly. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2016-0787 to this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libssh2_org fixes the following issues :

  - fix CVE-2016-0787 (boo#967026)

  - Weakness in diffie-hellman secret key generation

  - add CVE-2016-0787.patch

Andreas Schneider reported that libssh2, a SSH2 client-side library, passes the number of bytes to a function that expects number of bits during the SSHv2 handshake when libssh2 is to get a suitable value for'group order' in the Diffie-Hellman negotiation. This weakens significantly the handshake security, potentially allowing an eavesdropper with enough resources to decrypt or intercept SSH sessions.

Andreas Schneider reported that libssh2, an SSH2 protocol implementation used by many applications, did not generate sufficiently long Diffie-Hellman secrets.

This vulnerability could be exploited by an eavesdropper to decrypt and to intercept SSH sessions.

For the oldoldstable distribution (squeeze), this has been fixed in version 1.2.6-1+deb6u2. Although the changelog refers to 'sha256', this version only supports DH SHA-1 key exchange and it is that key exchange method that has been fixed.

For the oldstable (wheezy) and stable (jessie) distributions, this will be fixed soon.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
124932	EulerOS Virtualization 3.0.1.0 : libssh2 (EulerOS-SA-2019-1429)	Nessus	Huawei Local Security Checks	critical
124896	EulerOS Virtualization for ARM 64 3.0.1.0 : libssh2 (EulerOS-SA-2019-1393)	Nessus	Huawei Local Security Checks	high
99768	EulerOS 2.0 SP1 : libssh2 (EulerOS-SA-2016-1005)	Nessus	Huawei Local Security Checks	medium
92876	F5 Networks BIG-IP : libssh2 vulnerability (K21531693)	Nessus	F5 Networks Local Security Checks	medium
92558	Tenable SecurityCenter < 5.4.0 Multiple Vulnerabilities (TNS-2016-12)	Nessus	Misc.	high
91843	GLSA-201606-12 : libssh and libssh2: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
90365	Amazon Linux AMI : libssh2 (ALAS-2016-683)	Nessus	Amazon Linux Local Security Checks	medium
90166	openSUSE Security Update : libssh2_org (openSUSE-2016-388)	Nessus	SuSE Local Security Checks	medium
89923	SUSE SLED11 / SLES11 Security Update : libssh2_org (SUSE-SU-2016:0723-1)	Nessus	SuSE Local Security Checks	medium
89922	SUSE SLED12 / SLES12 Security Update : libssh2_org (SUSE-SU-2016:0718-1)	Nessus	SuSE Local Security Checks	medium
89863	Scientific Linux Security Update : libssh2 on SL6.x, SL7.x i386/x86_64 (20160310)	Nessus	Scientific Linux Local Security Checks	medium
89860	OracleVM 3.3 / 3.4 : libssh2 (OVMSA-2016-0035)	Nessus	OracleVM Local Security Checks	medium
89858	Oracle Linux 6 / 7 : libssh2 (ELSA-2016-0428)	Nessus	Oracle Linux Local Security Checks	medium
89849	CentOS 6 / 7 : libssh2 (CESA-2016:0428)	Nessus	CentOS Local Security Checks	medium
89820	RHEL 6 / 7 : libssh2 (RHSA-2016:0428)	Nessus	Red Hat Local Security Checks	medium
89802	Fedora 22 : libssh2-1.5.0-2.fc22 (2016-7942ee2cc5)	Nessus	Fedora Local Security Checks	medium
89652	openSUSE Security Update : libssh2_org (openSUSE-2016-295)	Nessus	SuSE Local Security Checks	medium
89491	Fedora 23 : libssh2-1.6.0-4.fc23 (2016-215a2219b1)	Nessus	Fedora Local Security Checks	medium
88915	Debian DSA-3487-1 : libssh2 - security update	Nessus	Debian Local Security Checks	medium
88914	Debian DLA-426-1 : libssh2 security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2016-0787

medium

Tenable Plugins

critical

high

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium