Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted USB device masquerading as a security token on a computer where the affected library is currently in use. It is not possible to perform this attack with a genuine YubiKey.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1755-1 advisory.

  - Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to     exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted     USB device masquerading as a security token on a computer where the affected library is currently in use.
    It is not possible to perform this attack with a genuine YubiKey. (CVE-2018-20340)

  - In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized     stack memory back to the device. (CVE-2019-9578)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libu2f-host fixes the following issues :

This update ships the u2f-host package (jsc#ECO-3687 bsc#1184648)

Version 1.1.10 (released 2019-05-15)

  - Add new devices to udev rules.

  - Fix a potentially uninitialized buffer (CVE-2019-9578,     bsc#1128140)

Version 1.1.9 (released 2019-03-06)

  - Fix CID copying from the init response, which broke     compatibility with some devices.

Version 1.1.8 (released 2019-03-05)

  - Add udev rules

  - Drop 70-old-u2f.rules and use 70-u2f.rules for     everything

  - Use a random nonce for setting up CID to prevent     fingerprinting

  - CVE-2019-9578: Parse the response to init in a more     stable way to prevent leakage of uninitialized stack     memory back to the device (bsc#1128140).

Version 1.1.7 (released 2019-01-08)

  - Fix for trusting length from device in device init.

  - Fix for buffer overflow when receiving data from device.
    (YSA-2019-01, CVE-2018-20340, bsc#1124781)

  - Add udev rules for some new devices.

  - Add udev rule for Feitian ePass FIDO 

  - Add a timeout to the register and authenticate actions.
    This update was imported from the SUSE:SLE-15:Update     update project.

This update for libu2f-host fixes the following issues :

This update ships the u2f-host package (jsc#ECO-3687 bsc#1184648)

Version 1.1.10 (released 2019-05-15)

Add new devices to udev rules.

Fix a potentially uninitialized buffer (CVE-2019-9578, bsc#1128140)

Version 1.1.9 (released 2019-03-06)

Fix CID copying from the init response, which broke compatibility with some devices.

Version 1.1.8 (released 2019-03-05)

Add udev rules

Drop 70-old-u2f.rules and use 70-u2f.rules for everything

Use a random nonce for setting up CID to prevent fingerprinting

CVE-2019-9578: Parse the response to init in a more stable way to prevent leakage of uninitialized stack memory back to the device (bsc#1128140).

Version 1.1.7 (released 2019-01-08)

Fix for trusting length from device in device init.

Fix for buffer overflow when receiving data from device. (YSA-2019-01, CVE-2018-20340, bsc#1124781)

Add udev rules for some new devices.

Add udev rule for Feitian ePass FIDO

  - Add a timeout to the register and authenticate actions.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202004-15 (libu2f-host: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libu2f-host. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to plug-in a malicious USB device,       possibly resulting in execution of arbitrary code with the privileges of       the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for libu2f-host and pam_u2f to version 1.0.8 fixes the following issues :

Security issues fixed for libu2f-host :

CVE-2019-9578: Fixed a memory leak due to a wrong parse of init's response (bsc#1128140).

CVE-2018-20340: Fixed an unchecked buffer, which could allow a buffer overflow with a custom made malicious USB device (bsc#1124781).

Security issues fixed for pam_u2f: CVE-2019-12209: Fixed an issue where symlinks in the user's directory were followed (bsc#1135729).

CVE-2019-12210: Fixed file descriptor leaks (bsc#1135727).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libu2f-host fixes the following issues: &#9; Security issue fixed :

  - CVE-2018-20340: Fixed an unchecked buffer, which could     allow a buffer overflow with a custom made malicious USB     device (bsc#1124781). This update was imported from the     SUSE:SLE-15:Update update project.

This update for libu2f-host fixes the following issues :

Security issue fixed :

CVE-2018-20340: Fixed an unchecked buffer, which could allow a buffer overflow with a custom made malicious USB device (bsc#1124781).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libu2f-host fixes the following issues :

Security issue fixed :

  - CVE-2018-20340: Fixed an unchecked buffer, which could     allow a buffer overflow with a custom made malicious USB     device (bsc#1124781).

Christian Reitter discovered that libu2f-host, a library implementing the host-side of the U2F protocol, failed to properly check for a buffer overflow. This would allow an attacker with a custom made malicious USB device masquerading as a security key, and physical access to a computer where PAM U2F or an application with libu2f-host integrated, to potentially execute arbitrary code on that computer.

ID	Name	Product	Family	Severity
151710	openSUSE 15 Security Update : libu2f-host (openSUSE-SU-2021:1755-1)	Nessus	SuSE Local Security Checks	medium
150098	openSUSE Security Update : libu2f-host (openSUSE-2021-799)	Nessus	SuSE Local Security Checks	medium
149976	SUSE SLED15 / SLES15 Security Update : libu2f-host (SUSE-SU-2021:1755-1)	Nessus	SuSE Local Security Checks	medium
136214	GLSA-202004-15 : libu2f-host: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
126501	SUSE SLED12 / SLES12 Security Update : libu2f-host (SUSE-SU-2019:1749-1)	Nessus	SuSE Local Security Checks	high
125617	openSUSE Security Update : libu2f-host (openSUSE-2019-1475)	Nessus	SuSE Local Security Checks	medium
125460	SUSE SLED15 / SLES15 Security Update : libu2f-host (SUSE-SU-2019:1340-1)	Nessus	SuSE Local Security Checks	medium
122299	openSUSE Security Update : libu2f-host (openSUSE-2019-199)	Nessus	SuSE Local Security Checks	medium
122102	Debian DSA-4389-1 : libu2f-host - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2018-20340

medium

Tenable Plugins

medium

medium

medium

medium

high

medium

medium

medium

medium