Updated libssh2 packages fix security vulnerability :

Mariusz Ziulek reported that libssh2, a SSH2 client-side library, was reading and using the SSH_MSG_KEXINIT packet without doing sufficient range checks when negotiating a new SSH session with a remote server.
A malicious attacker could man in the middle a real server and cause a client using the libssh2 library to crash (denial of service) or otherwise read and use unintended memory areas in this process (CVE-2015-1782).

Update :

Packages were misssing for Mandriva Business Server 1 with the MDVSA-2015:148 advisory which are now being provided.

The ssh client library libssh2_org was updated to fix a security issue :

  - A malicious server could send a crafted SSH_MSG_KEXINIT     packet, that could lead to a buffer overread and to a     crash of the application using libssh2_org.
    (CVE-2015-1782)

Updated libssh2 packages that fix one security issue and two bugs are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libssh2 packages provide a library that implements the SSH2 protocol.

A flaw was found in the way the kex_agree_methods() function of libssh2 performed a key exchange when negotiating a new SSH session. A man-in-the-middle attacker could use a crafted SSH_MSG_KEXINIT packet to crash a connecting libssh2 client. (CVE-2015-1782)

This update also fixes the following bugs :

* Previously, libssh2 did not correctly adjust the size of the receive window while reading from an SSH channel. This caused downloads over the secure copy (SCP) protocol to consume an excessive amount of memory. A series of upstream patches has been applied on the libssh2 source code to improve handling of the receive window size. Now, SCP downloads work as expected. (BZ#1080459)

* Prior to this update, libssh2 did not properly initialize an internal variable holding the SSH agent file descriptor, which caused the agent destructor to close the standard input file descriptor by mistake. An upstream patch has been applied on libssh2 sources to properly initialize the internal variable. Now, libssh2 closes only the file descriptors it owns. (BZ#1147717)

All libssh2 users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing these updated packages, all running applications using libssh2 must be restarted for this update to take effect.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to cause a denial of service     (crash) or have other unspecified impact via crafted length values in an SSH_MSG_KEXINIT packet.
    (CVE-2015-1782)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the libssh2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A type confusion issue was found in the way libssh2     generated ephemeral secrets for the     diffie-hellman-group1 and diffie-hellman-group14 key     exchange methods. This would cause an SSHv2     Diffie-Hellman handshake to use significantly less     secure random parameters.(CVE-2016-0787)

  - A flaw was found in the way the kex_agree_methods()     function of libssh2 performed a key exchange when     negotiating a new SSH session. A man-in-the-middle     attacker could use a crafted SSH_MSG_KEXINIT packet to     crash a connecting libssh2 client.(CVE-2015-1782)

  - An integer overflow flaw which could lead to an out of     bounds write was discovered in libssh2 in the way     SSH_MSG_CHANNEL_REQUEST packets with an exit signal are     parsed. A remote attacker who compromises a SSH server     may be able to execute code on the client system when a     user connects to the server.(CVE-2019-3857)

  - An out of bounds read flaw was discovered in libssh2     before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets     with an exit status message and no payload are parsed.
    A remote attacker who compromises a SSH server may be     able to cause a Denial of Service or read data in the     client memory.(CVE-2019-3862)

  - An integer overflow flaw, which could lead to an out of     bounds write, was discovered in libssh2 before 1.8.1 in     the way keyboard prompt requests are parsed. A remote     attacker who compromises a SSH server may be able to     execute code on the client system when a user connects     to the server.(CVE-2019-3856)

  - A flaw was found in libssh2 before 1.8.1. A server     could send a multiple keyboard interactive response     messages whose total length are greater than unsigned     char max characters. This value is used as an index to     copy memory causing in an out of bounds memory write     error.(CVE-2019-3863)

  - An integer overflow flaw which could lead to an out of     bounds write was discovered in libssh2 before 1.8.1 in     the way packets are read from the server. A remote     attacker who compromises a SSH server may be able to     execute code on the client system when a user connects     to the server.(CVE-2019-3855)

  - An out of bounds read flaw was discovered in libssh2     before 1.8.1 when a specially crafted SFTP packet is     received from the server. A remote attacker who     compromises a SSH server may be able to cause a Denial     of Service or read data in the client     memory.(CVE-2019-3858)

  - An out of bounds read flaw was discovered in libssh2     before 1.8.1 in the _libssh2_packet_require and
    _libssh2_packet_requirev functions. A remote attacker     who compromises a SSH server may be able to cause a     Denial of Service or read data in the client     memory.(CVE-2019-3859)

  - An out of bounds read flaw was discovered in libssh2     before 1.8.1 in the way SFTP packets with empty     payloads are parsed. A remote attacker who compromises     a SSH server may be able to cause a Denial of Service     or read data in the client memory.(CVE-2019-3860)

  - An out of bounds read flaw was discovered in libssh2     before 1.8.1 in the way SSH packets with a padding     length value greater than the packet length are parsed.
    A remote attacker who compromises a SSH server may be     able to cause a Denial of Service or read data in the     client memory.(CVE-2019-3861)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update, to the current upstream release version, contains numerous bug fixes and enhancements as described in the RELEASE-NOTES file.

These include a security fix for CVE-2015-1782 :

A malicious attacker could man in the middle a real server and cause libssh2-using clients to crash (denial of service) or otherwise read and use completely unintended memory areas in this process. There are no known exploits of this flaw at this time.

See http://www.libssh2.org/adv_20150311.html for further details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mariusz Ziulek reports :

A malicious attacker could man in the middle a real server and cause libssh2 using clients to crash (denial of service) or otherwise read and use completely unintended memory areas in this process.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-2140 advisory.

    - check length of data extracted from the SSH_MSG_KEXINIT packet (CVE-2015-1782)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Mariusz Ziulek reported that libssh2, a SSH2 client-side library, was reading and using the SSH_MSG_KEXINIT packet without doing sufficient range checks when negotiating a new SSH session with a remote server.
A malicious attacker could man in the middle a real server and cause a client using the libssh2 library to crash (denial of service) or otherwise read and use unintended memory areas in this process.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
82401	Mandriva Linux Security Advisory : libssh2 (MDVSA-2015:148-1)	Nessus	Mandriva Local Security Checks	2015/3/30	2021/1/14	medium
82640	SuSE 11.3 Security Update : libssh2_org (SAT Patch Number 10426)	Nessus	SuSE Local Security Checks	2015/4/8	2021/1/6	medium
87133	CentOS 7 : libssh2 (CESA-2015:2140)	Nessus	CentOS Local Security Checks	2015/12/2	2021/1/4	medium
218558	Linux Distros Unpatched Vulnerability : CVE-2015-1782	Nessus	Misc.	2025/3/4	2026/7/28	critical
124932	EulerOS Virtualization 3.0.1.0 : libssh2 (EulerOS-SA-2019-1429)	Nessus	Huawei Local Security Checks	2019/5/14	2022/5/20	critical
82433	Fedora 20 : libssh2-1.5.0-1.fc20 (2015-3791)	Nessus	Fedora Local Security Checks	2015/3/31	2021/1/11	medium
86080	FreeBSD : libssh2 -- denial of service vulnerability (9770d6ac-614d-11e5-b379-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	2015/9/23	2021/1/6	medium
87024	Oracle Linux 7 : libssh2 (ELSA-2015-2140)	Nessus	Oracle Linux Local Security Checks	2015/11/24	2025/4/29	critical
81960	Fedora 21 : libssh2-1.5.0-1.fc21 (2015-3797)	Nessus	Fedora Local Security Checks	2015/3/20	2021/1/11	medium
82156	Debian DLA-171-1 : libssh2 security update	Nessus	Debian Local Security Checks	2015/3/26	2021/1/11	medium
86932	RHEL 7 : libssh2 (RHSA-2015:2140)	Nessus	Red Hat Local Security Checks	2015/11/19	2019/10/24	medium

检测

插件搜索

medium

medium

medium

critical

critical

medium

medium

critical

medium

medium

medium