A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.

libssh versions 0.6 and above have an authentication bypass vulnerability in the server code. By presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication, the attacker could successfully authenticate without any credentials.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

According to the version of the libssh package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A vulnerability was found in libssh's server-side state     machine before versions 0.7.6 and 0.8.4. A malicious     client could create channels without first performing     authentication, resulting in unauthorized     access.(CVE-2018-10933)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libssh fixes the following issues :

  - CVE-2018-10933: Fixed a server mode authentication     bypass (bsc#1108020).

This update was imported from the SUSE:SLE-15:Update update project.

Update to version 0.8.4 to address CVE-2018-10933

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to version 0.8.4 to fix CVE-2018-10933

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libssh fixes the following issues :

CVE-2018-10933: Fixed a server mode authentication bypass (bsc#1108020).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-3795-1 fixed a vulnerability in libssh. This update provides the corresponding update for Ubuntu 18.10.

Peter Winter-Smith discovered that libssh incorrectly handled authentication when being used as a server. A remote attacker could use this issue to bypass authentication without any credentials.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libssh fixes the following issues :

Security issue fixed :

CVE-2018-10933: Fixed a server mode authentication bypass (bsc#1108020).

Non security issue fixed: Fix popd syntax to be compatible with newer versions of the bash shell.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libssh fixes the following security issue :

  - CVE-2018-10933: Fixed a server mode authentication     bypass (boo#1108020).

This update was imported from the SUSE:SLE-12:Update update project.

Update to version 0.7.6 to address CVE-2018-10933

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Peter Winter-Smith of NCC Group discovered that libssh, a tiny C SSH library, contains an authentication bypass vulnerability in the server code. An attacker can take advantage of this flaw to successfully authenticate without any credentials by presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication.

For Debian 8 'Jessie', this problem has been fixed in version 0.6.3-4+deb8u3.

We recommend that you upgrade your libssh packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Peter Winter-Smith discovered that libssh incorrectly handled authentication when being used as a server. A remote attacker could use this issue to bypass authentication without any credentials.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

gladiac reports :

libssh versions 0.6 and above have an authentication bypass vulnerability in the server code. By presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication, the attacker could successfully authentciate without any credentials.

Peter Winter-Smith of NCC Group discovered that libssh, a tiny C SSH library, contains an authentication bypass vulnerability in the server code. An attacker can take advantage of this flaw to successfully authenticate without any credentials by presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication.

New libssh packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix a security issue.

According to its banner version, the remote libssh based server is vulnerable to an authentication bypass.  An attacker can bypass authentication by presenting a SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST method that normally would initiate authentication.

Note that Nessus did not actually test for the flaw but instead has relied on the version in the libssh banner so this may be a false positive.

The remote ssh server is vulnerable to an authentication bypass. An attacker can bypass authentication by presenting SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST method that normally would initiate authentication.

Note: This vulnerability was disclosed in a libssh advisory but has also been observed as applicable to other applications and software packages.

ID	Name	Product	Family	Severity
502173	Westermo xRD Products Authentication Bypass (CVE-2018-10933)	Tenable OT Security	Tenable.ot	critical
129260	EulerOS 2.0 SP3 : libssh (EulerOS-SA-2019-2067)	Nessus	Huawei Local Security Checks	critical
123341	openSUSE Security Update : libssh (openSUSE-2019-806)	Nessus	SuSE Local Security Checks	critical
120760	Fedora 28 : libssh (2018-c08cd808d3)	Nessus	Fedora Local Security Checks	critical
120502	Fedora 29 : libssh (2018-6b390ceb36)	Nessus	Fedora Local Security Checks	critical
120131	SUSE SLED15 / SLES15 Security Update : libssh (SUSE-SU-2018:3162-1)	Nessus	SuSE Local Security Checks	critical
118325	Ubuntu 18.10 : libssh vulnerability (USN-3795-2)	Nessus	Ubuntu Local Security Checks	critical
118306	SUSE SLED12 Security Update : libssh (SUSE-SU-2018:3253-1)	Nessus	SuSE Local Security Checks	critical
118250	openSUSE Security Update : libssh (openSUSE-2018-1207)	Nessus	SuSE Local Security Checks	critical
118243	Fedora 27 : libssh (2018-bca1c1ab49)	Nessus	Fedora Local Security Checks	critical
118214	Debian DLA-1548-1 : libssh security update	Nessus	Debian Local Security Checks	critical
118200	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : libssh vulnerability (USN-3795-1)	Nessus	Ubuntu Local Security Checks	critical
118191	openSUSE Security Update : libssh (openSUSE-2018-1180)	Nessus	SuSE Local Security Checks	critical
118182	FreeBSD : libssh -- authentication bypass vulnerability (2383767c-d224-11e8-9623-a4badb2f4699)	Nessus	FreeBSD Local Security Checks	critical
118180	Debian DSA-4322-1 : libssh - security update	Nessus	Debian Local Security Checks	critical
118168	Slackware 14.0 / 14.1 / 14.2 / current : libssh (SSA:2018-289-01)	Nessus	Slackware Local Security Checks	critical
118155	libssh 0.6.x / 0.7.x < 0.7.6 / 0.8.x < 0.8.4 Authentication Bypass (Remote Version Check)	Nessus	Misc.	critical
118154	SSH Protocol Authentication Bypass (Remote Exploit Check)	Nessus	Misc.	high

Detections

Analytics

CVE-2018-10933

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high