Double free vulnerability in the sftp_mkdir function in sftp.c in libssh before 0.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors, a different vector than CVE-2012-4559.

The remote host is affected by the vulnerability described in GLSA-201402-26 (libssh: Arbitrary code execution)

    Multiple buffer overflow, double free, and integer overflow       vulnerabilities have been discovered in libssh.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This is an important SECURITY and maintenance release in order to address CVE-2012-4559, CVE-2012-4560, CVE-2012-4561 and CVE-2012-4562.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities were discovered in libssh by Florian Weimer and Xi Wang :

  - CVE-2012-4559: multiple double free() flaws
  - CVE-2012-4561: multiple invalid free() flaws
  - CVE-2012-4562: multiple improper overflow checks

Those could lead to a denial of service by making an SSH client linked to libssh crash, and maybe even arbitrary code execution.

ID	Name	Product	Family	Severity
72640	GLSA-201402-26 : libssh: Arbitrary code execution	Nessus	Gentoo Local Security Checks	high
63173	Fedora 16 : libssh-0.5.3-1.fc16 (2012-18687)	Nessus	Fedora Local Security Checks	high
63125	Debian DSA-2577-1 : libssh - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2012-6063

critical

Tenable Plugins

high

high

high