A vulnerability was discovered in libssh2 before 1.9.0, `kex_method_diffie_hellman_group_exchange_sha256_key_exchange` in `kex.c` has an integer overflow that could lead to an out-of-bounds write in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

This is related to an `_libssh2_check_length` mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.

This update, to the latest current upstream release 1.9.0, addresses this security issue and also includes a number of other bug fixes and enhancements as described in the package changelog.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the libssh2 package has been released.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5308-1 advisory.

  - In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an     integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A     remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a     denial of service condition on the client system when a user connects to the server. This is related to an
    _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as     CVE-2019-3855. (CVE-2019-13115)

  - In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow     in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent     memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of     service condition on the client system when a user connects to the server. (CVE-2019-17498)

  - An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1     in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to     execute code on the client system when a user connects to the server. (CVE-2019-3855)

  - An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before     1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may     be able to execute code on the client system when a user connects to the server. (CVE-2019-3856)

  - An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1     in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who     compromises a SSH server may be able to execute code on the client system when a user connects to the     server. (CVE-2019-3857)

  - An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is     received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of     Service or read data in the client memory. (CVE-2019-3858)

  - An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and
    _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a     Denial of Service or read data in the client memory. (CVE-2019-3859)

  - An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty     payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of     Service or read data in the client memory. (CVE-2019-3860)

  - An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding     length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may     be able to cause a Denial of Service or read data in the client memory. (CVE-2019-3861)

  - An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST     packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH     server may be able to cause a Denial of Service or read data in the client memory. (CVE-2019-3862)

  - A flaw was found in libssh2 before 1.8.1. A server could send a multiple keyboard interactive response     messages whose total length are greater than unsigned char max characters. This value is used as an index     to copy memory causing in an out of bounds memory write error. (CVE-2019-3863)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2848 advisory.

  - In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an     integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A     remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a     denial of service condition on the client system when a user connects to the server. This is related to an
    _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as     CVE-2019-3855. (CVE-2019-13115)

  - In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow     in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent     memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of     service condition on the client system when a user connects to the server. (CVE-2019-17498)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3559 advisory.

  - In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an     integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A     remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a     denial of service condition on the client system when a user connects to the server. This is related to an
    _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as     CVE-2019-3855. (CVE-2019-13115)

  - In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow     in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent     memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of     service condition on the client system when a user connects to the server. (CVE-2019-17498)

  - An issue was discovered in function _libssh2_packet_add in libssh2 1.10.0 allows attackers to access out     of bounds memory. (CVE-2020-22218)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
127512	Fedora 29 : libssh2 (2019-5885663621)	Nessus	Fedora Local Security Checks	8/12/2019	1/6/2020	high
127521	Fedora 30 : libssh2 (2019-9d85600fc7)	Nessus	Fedora Local Security Checks	8/12/2019	1/6/2020	high
129102	Photon OS 3.0: Libssh2 PHSA-2019-3.0-0026	Nessus	PhotonOS Local Security Checks	9/23/2019	12/24/2019	high
183694	Ubuntu 16.04 ESM : libssh2 vulnerabilities (USN-5308-1)	Nessus	Ubuntu Local Security Checks	10/23/2023	10/23/2023	critical
156173	Debian DLA-2848-1 : libssh2 - LTS security update	Nessus	Debian Local Security Checks	12/18/2021	11/22/2023	high
181187	Debian DLA-3559-1 : libssh2 - LTS security update	Nessus	Debian Local Security Checks	9/8/2023	9/8/2023	high

Detections

Analytics

Plugins Search

high

high

high

critical

high

high