libssh 0.6.x / 0.7.x < 0.7.6 / 0.8.x < 0.8.4 Authentication Bypass (Remote Version Check)

High Nessus Plugin ID 118155

Synopsis

The remote server is vulnerable to an authentication bypass.

Description

According to its banner version, the remote libssh based server is vulnerable to an authentication bypass. An attacker can bypass authentication by presenting a SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST method that normally would initiate authentication.

Note that Nessus did not actually test for the flaw but instead has relied on the version in the libssh banner so this may be a false positive.

Solution

Upgrade to libssh 0.7.6 / 0.8.4 or later.

See Also

http://www.nessus.org/u?6f6b157e

Plugin Details

Severity: High

ID: 118155

File Name: libssh_0_8_4.nasl

Version: 1.12

Type: remote

Family: Misc.

Published: 2018/10/17

Updated: 2019/04/05

Dependencies: 17975

Configuration: Enable paranoid mode

Risk Information

Risk Factor: High

CVSS Score Source: manual

CVSS Score Rationale: Nvd score unavailable.

CVSS v2.0

Base Score: 9.3

Temporal Score: 7.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

CVSS v3.0

Base Score: 8.1

Temporal Score: 7.3

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Required KB Items: Settings/ParanoidReport

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 2018/10/16

Reference Information

CVE: CVE-2018-10933

IAVA: 2018-A-0347