Mariusz Ziulek reported that libssh2, a SSH2 client-side library, was reading and using the SSH_MSG_KEXINIT packet without doing sufficient range checks when negotiating a new SSH session with a remote server.
A malicious attacker could man in the middle a real server and cause a client using the libssh2 library to crash (denial of service) or otherwise read and use unintended memory areas in this process.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated libssh2 packages that fix one security issue and two bugs are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libssh2 packages provide a library that implements the SSH2 protocol.

A flaw was found in the way the kex_agree_methods() function of libssh2 performed a key exchange when negotiating a new SSH session. A man-in-the-middle attacker could use a crafted SSH_MSG_KEXINIT packet to crash a connecting libssh2 client. (CVE-2015-1782)

This update also fixes the following bugs :

* Previously, libssh2 did not correctly adjust the size of the receive window while reading from an SSH channel. This caused downloads over the secure copy (SCP) protocol to consume an excessive amount of memory. A series of upstream patches has been applied on the libssh2 source code to improve handling of the receive window size. Now, SCP downloads work as expected. (BZ#1080459)

* Prior to this update, libssh2 did not properly initialize an internal variable holding the SSH agent file descriptor, which caused the agent destructor to close the standard input file descriptor by mistake. An upstream patch has been applied on libssh2 sources to properly initialize the internal variable. Now, libssh2 closes only the file descriptors it owns. (BZ#1147717)

All libssh2 users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing these updated packages, all running applications using libssh2 must be restarted for this update to take effect.

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2015-623:01 advisory.

    libssh2 is a library implementing the SSH2 protocol as defined by     Internet Drafts: SECSH-TRANS(22), SECSH-USERAUTH(25),     SECSH-CONNECTION(23), SECSH-ARCH(20), SECSH-FILEXFER(06)*,     SECSH-DHGEX(04), and SECSH-NUMBERS(10).
    Security issues fixed with this release:
    CVE-2015-1782     The kex_agree_methods function in libssh2 before 1.5.0 allows remote     servers to cause a denial of service (crash) or have other unspecified     impact via crafted length values in an SSH_MSG_KEXINIT packet.
    Fixed bugs:
    * Previously, libssh2 did not correctly adjust the size of the receive window while reading from an SSH     channel. This caused downloads over the secure copy (SCP) protocol to consume an excessive amount of     memory. A series of upstream patches has been applied on the libssh2 source code to improve handling of     the receive window size. Now, SCP downloads work as expected.
    * Prior to this update, libssh2 did not properly initialize an internal variable holding the SSH agent     file descriptor, which caused the agent destructor to close the standard input file descriptor by mistake.
    An upstream patch has been applied on libssh2 sources to properly initialize the internal variable. Now,     libssh2 closes only the file descriptors it owns.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update, to the current upstream release version, contains numerous bug fixes and enhancements as described in the RELEASE-NOTES file.

These include a security fix for CVE-2015-1782 :

A malicious attacker could man in the middle a real server and cause libssh2-using clients to crash (denial of service) or otherwise read and use completely unintended memory areas in this process. There are no known exploits of this flaw at this time.

See http://www.libssh2.org/adv_20150311.html for further details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the way the kex_agree_methods() function of libssh2 performed a key exchange when negotiating a new SSH session. A man-in-the- middle attacker could use a crafted SSH_MSG_KEXINIT packet to crash a connecting libssh2 client. (CVE-2015-1782)

This update also fixes the following bugs :

  - Previously, libssh2 did not correctly adjust the size of     the receive window while reading from an SSH channel.
    This caused downloads over the secure copy (SCP)     protocol to consume an excessive amount of memory. A     series of upstream patches has been applied on the     libssh2 source code to improve handling of the receive     window size. Now, SCP downloads work as expected.

  - Prior to this update, libssh2 did not properly     initialize an internal variable holding the SSH agent     file descriptor, which caused the agent destructor to     close the standard input file descriptor by mistake. An     upstream patch has been applied on libssh2 sources to     properly initialize the internal variable. Now, libssh2     closes only the file descriptors it owns.

After installing these updated packages, all running applications using libssh2 must be restarted for this update to take effect.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to cause a denial of service     (crash) or have other unspecified impact via crafted length values in an SSH_MSG_KEXINIT packet.
    (CVE-2015-1782)

Note that Nessus relies on the presence of the package as reported by the vendor.

Updated libssh2 packages fix security vulnerability :

Mariusz Ziulek reported that libssh2, a SSH2 client-side library, was reading and using the SSH_MSG_KEXINIT packet without doing sufficient range checks when negotiating a new SSH session with a remote server.
A malicious attacker could man in the middle a real server and cause a client using the libssh2 library to crash (denial of service) or otherwise read and use unintended memory areas in this process (CVE-2015-1782).

Update :

Packages were misssing for Mandriva Business Server 1 with the MDVSA-2015:148 advisory which are now being provided.

The ssh client library libssh2_org was updated to fix a security issue :

  - A malicious server could send a crafted SSH_MSG_KEXINIT     packet, that could lead to a buffer overread and to a     crash of the application using libssh2_org.
    (CVE-2015-1782)

Mariusz Ziulek reported that libssh2, a SSH2 client-side library, was reading and using the SSH_MSG_KEXINIT packet without doing sufficient range checks when negotiating a new SSH session with a remote server.
A malicious attacker could man in the middle a real server and cause a client using the libssh2 library to crash (denial of service) or otherwise read and use unintended memory areas in this process.

libssh2_org was updated to version 1.5.0 to fix bugs and a security issue.

Changes in 1.5.0: Added Windows Cryptography API: Next Generation based backend

Bug fixes :

  - Security Advisory: Using `SSH_MSG_KEXINIT` data     unbounded, CVE-2015-1782

  - missing _libssh2_error in _libssh2_channel_write

  - knownhost: Fix DSS keys being detected as unknown.

  - knownhost: Restore behaviour of     `libssh2_knownhost_writeline` with short buffer.

  - libssh2.h: on Windows, a socket is of type SOCKET, not     int

  - libssh2_priv.h: a 1 bit bit-field should be unsigned

  - windows build: do not export externals from static     library

  - Fixed two potential use-after-frees of the payload     buffer

  - Fixed a few memory leaks in error paths

  - userauth: Fixed an attempt to free from stack on error

  - agent_list_identities: Fixed memory leak on OOM

  - knownhosts: Abort if the hosts buffer is too small

  - sftp_close_handle: ensure the handle is always closed

  - channel_close: Close the channel even in the case of     errors

  - docs: added missing libssh2_session_handshake.3 file

  - docs: fixed a bunch of typos

  - userauth_password: pass on the underlying error code

  - _libssh2_channel_forward_cancel: accessed struct after     free

  - _libssh2_packet_add: avoid using uninitialized memory

  - _libssh2_channel_forward_cancel: avoid memory leaks on     error

  - _libssh2_channel_write: client spins on write when     window full

  - windows build: fix build errors

  - publickey_packet_receive: avoid junk in returned     pointers

  - channel_receive_window_adjust: store windows size always

  - userauth_hostbased_fromfile: zero assign to avoid     uninitialized use

  - configure: change LIBS not LDFLAGS when checking for     libs

  - agent_connect_unix: make sure there's a trailing zero

  - MinGW build: Fixed redefine warnings.

  - sftpdir.c: added authentication method detection.

  - Watcom build: added support for WinCNG build.

  - configure.ac: replace AM_CONFIG_HEADER with     AC_CONFIG_HEADERS

  - sftp_statvfs: fix for servers not supporting statfvs     extension

  - knownhost.c: use LIBSSH2_FREE macro instead of free

  - Fixed compilation using mingw-w64

  - knownhost.c: fixed that 'key_type_len' may be used     uninitialized

  - configure: Display individual crypto backends on     separate lines

  - examples on Windows: check for WSAStartup return code

  - examples on Windows: check for socket return code

  - agent.c: check return code of MapViewOfFile

  - kex.c: fix possible NULL pointer de-reference with     session->kex

  - packet.c: fix possible NULL pointer de-reference within     listen_state

  - tests on Windows: check for WSAStartup return code

  - userauth.c: improve readability and clarity of for-loops

  - examples on Windows: use native SOCKET-type instead of     int

  - packet.c: i < 256 was always true and i would overflow     to 0

  - kex.c: make sure mlist is not set to NULL

  - session.c: check return value of session_nonblock in     debug mode

  - session.c: check return value of session_nonblock during     startup

  - userauth.c: make sure that sp_len is positive and avoid     overflows

  - knownhost.c: fix use of uninitialized argument variable     wrote

  - openssl: initialise the digest context before calling     EVP_DigestInit()

  - libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET

  - configure.ac: Add zlib to Requires.private in libssh2.pc     if using zlib

  - configure.ac: Rework crypto library detection

  - configure.ac: Reorder --with-* options in --help output

  - configure.ac: Call zlib zlib and not libz in text but     keep option names

  - Fix non-autotools builds: Always define the     LIBSSH2_OPENSSL CPP macro

  - sftp: seek: Don't flush buffers on same offset

  - sftp: statvfs: Along error path, reset the correct     'state' variable.

  - sftp: Add support for fsync (OpenSSH extension).

  - _libssh2_channel_read: fix data drop when out of window

  - comp_method_zlib_decomp: Improve buffer growing     algorithm

  - _libssh2_channel_read: Honour window_size_initial

  - window_size: redid window handling for flow control     reasons

  - knownhosts: handle unknown key types

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
82156	Debian DLA-171-1 : libssh2 security update	Nessus	Debian Local Security Checks	2015/3/26	2021/1/11	medium
86932	RHEL 7 : libssh2 (RHSA-2015:2140)	Nessus	Red Hat Local Security Checks	2015/11/19	2019/10/24	medium
289709	MiracleLinux 7 : libssh2-1.4.3-10.el7 (AXSA:2015-623:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
81866	Fedora 22 : libssh2-1.5.0-1.fc22 (2015-3757)	Nessus	Fedora Local Security Checks	2015/3/17	2021/1/11	medium
87561	Scientific Linux Security Update : libssh2 on SL7.x x86_64 (20151119)	Nessus	Scientific Linux Local Security Checks	2015/12/22	2021/1/14	medium
218558	Linux Distros Unpatched Vulnerability : CVE-2015-1782	Nessus	Misc.	2025/3/4	2025/9/4	critical
82401	Mandriva Linux Security Advisory : libssh2 (MDVSA-2015:148-1)	Nessus	Mandriva Local Security Checks	2015/3/30	2021/1/14	medium
82640	SuSE 11.3 Security Update : libssh2_org (SAT Patch Number 10426)	Nessus	SuSE Local Security Checks	2015/4/8	2021/1/6	medium
87133	CentOS 7 : libssh2 (CESA-2015:2140)	Nessus	CentOS Local Security Checks	2015/12/2	2021/1/4	medium
81760	Debian DSA-3182-1 : libssh2 - security update	Nessus	Debian Local Security Checks	2015/3/12	2021/1/11	medium
81946	openSUSE Security Update : libssh2_org (openSUSE-2015-242)	Nessus	SuSE Local Security Checks	2015/3/19	2021/1/19	medium

检测

插件搜索

medium

medium

critical

medium

medium

critical

medium

medium

medium

medium

medium