In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an     integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A     remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a     denial of service condition on the client system when a user connects to the server. This is related to an
    _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as     CVE-2019-3855. (CVE-2019-13115)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5308-1 advisory.

    It was discovered that libssh2 mishandled certain input. If libssh2 were used to connect to a malicious or     compromised SSH server, a remote, unauthenticated attacker could possibly execute arbitrary code on the     client

    system. (CVE-2019-3855)

    It was discovered that libssh2 incorrectly handled prompt requests. A remote attacker could possibly use     this issue to execute arbitrary code. (CVE-2019-3856)

    It was discovered that libssh2 incorrectly handled SSH_MSG_CHANNEL_REQUEST packets. A remote attacker     could possibly use this issue to execute arbitrary code, cause a denial of service, or obtain sensitive     information.

    (CVE-2019-3857, CVE-2019-3862)

    It was discovered that libssh2 incorrectly handled specially crafted SFTP packets. A remote attacker could     possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-3858)

    It was discovered that libssh2 incorrectly handled certain specially crafted packets. A remote attacker     could possibly use this issue to cause a denial of service or obtain sensitive information.
    (CVE-2019-3859)

    It was discovered that libssh2 incorrectly handled SFTP packets with empty payloads. A remote attacker     could possibly use this issue to cause a denial of service or obtain sensitive information.
    (CVE-2019-3860)

    It was discovered that libssh2 incorrectly handled padding values in SSH packets. A remote attacker could     possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-3861)

    It was discovered that libssh2 incorrectly handled interactive response messages length. A remote attacker     could possibly use this issue to execute arbitrary code. (CVE-2019-3863)

    It was discovered that libssh2 incorrectly handled the Diffie Hellman key exchange. A remote attacker     could possibly use this issue to cause a denial of service or obtain sensitive information.
    (CVE-2019-13115)

    It was discovered that libssh2 incorrectly handled bound checks in SSH_MSG_DISCONNECT. A remote attacker     could possibly use this issue to cause a denial of service or obtain sensitive information.
    (CVE-2019-17498)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3559 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3559-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     September 08, 2023                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libssh2     Version        : 1.8.0-2.1+deb10u1     CVE ID         : CVE-2019-13115 CVE-2019-17498 CVE-2020-22218     Debian Bug     : 932329 943562

    Vulnerabilities were found in libssh2, a client-side C library     implementing the SSH2 protocol, which could lead to denial of service or     remote information disclosure.

    CVE-2019-13115

        Kevin Backhouse discovered an integer overflow vulnerability in kex.c's         kex_method_diffie_hellman_group_exchange_sha256_key_exchange()         function, which could lead to an out-of-bounds read in the way         packets are read from the server.  A remote attacker who compromises         an SSH server may be able to disclose sensitive information or cause         a denial of service condition on the client system when a user         connects to the server.

    CVE-2019-17498

        Kevin Backhouse discovered that the SSH_MSG_DISCONNECT logic in         packet.c has an integer overflow in a bounds check, thereby enabling         an attacker to specify an arbitrary (out-of-bounds) offset for a         subsequent memory read.  A malicious SSH server may be able to         disclose sensitive information or cause a denial of service         condition on the client system when a user connects to the server.

    CVE-2020-22218

        An issue was discovered in function _libssh2_packet_add(), which         could allow attackers to access out of bounds memory.

    For Debian 10 buster, these problems have been fixed in version     1.8.0-2.1+deb10u1.

    We recommend that you upgrade your libssh2 packages.

    For the detailed security status of libssh2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libssh2

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2848 advisory.

    Two issues have been discovered in libssh2, a client-side C library implementing the SSH2 protocol:
    CVE-2019-13115: kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer     overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote     attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of     service condition on the client system when a user connects to the server. CVE-2019-17498:
    SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to     specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able     to disclose sensitive information or cause a denial of service condition on the client system when a user     connects to the server. For Debian 9 stretch, these problems have been fixed in version 1.7.0-1+deb9u2. We     recommend that you upgrade your libssh2 packages. For the detailed security status of libssh2 please refer     to its security tracker page at: https://security-tracker.debian.org/tracker/libssh2 Further information     about Debian LTS security advisories, how to apply these updates to your system and frequently asked     questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the libssh2 package has been released.

A vulnerability was discovered in libssh2 before 1.9.0, `kex_method_diffie_hellman_group_exchange_sha256_key_exchange` in `kex.c` has an integer overflow that could lead to an out-of-bounds write in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

This is related to an `_libssh2_check_length` mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.

This update, to the latest current upstream release 1.9.0, addresses this security issue and also includes a number of other bug fixes and enhancements as described in the package changelog.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
222592	Linux Distros Unpatched Vulnerability : CVE-2019-13115	Nessus	Misc.	high
183694	Ubuntu 16.04 ESM : libssh2 vulnerabilities (USN-5308-1)	Nessus	Ubuntu Local Security Checks	critical
181187	Debian dla-3559 : libssh2-1 - security update	Nessus	Debian Local Security Checks	high
156173	Debian DLA-2848-1 : libssh2 - LTS security update	Nessus	Debian Local Security Checks	high
129102	Photon OS 3.0: Libssh2 PHSA-2019-3.0-0026	Nessus	PhotonOS Local Security Checks	high
127521	Fedora 30 : libssh2 (2019-9d85600fc7)	Nessus	Fedora Local Security Checks	high
127512	Fedora 29 : libssh2 (2019-5885663621)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2019-13115

high

Tenable Plugins

high

critical

high

high

high

high

high