The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c in libssh before 0.6.5 do not properly validate state, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted SSH packet.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2912-1 advisory.

    Mariusz Ziulek discovered that libssh incorrectly handled certain packets. A remote attacker could     possibly use this issue to cause libssh to crash, resulting in a denial of service. (CVE-2015-3146)

    Aris Adamantiadis discovered that libssh incorrectly generated ephemeral secret keys of 128 bits instead     of the recommended 1024 or 2048 bits when using the diffie-hellman-group1 and diffie-hellman-group14     methods. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be     exploited to view sensitive information. (CVE-2016-0739)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The encryption library libssh was updated to fix one security issue.

The following vulnerability was fixed :

  - CVE-2015-3146: Unauthenticated remote attackers could     crash the server or client with specially crafted     packages.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to version 0.7.1 Add patch to fix undefined symbol:
ssh_forward_listen (bug #1221310)

Update to version 0.7.0 Security fix for CVE-2015-3146

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2015-3146

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

libssh was updated to fix one security issue.

The following vulnerability was fixed :

  - CVE-2015-3146: Specially crafted packages inserted into     a connection could have lead to a client or server     process crash via a NULL pointer dereference.

Andreas Schneider reports :

libssh versions 0.5.1 and above have a logical error in the handling of a SSH_MSG_NEWKEYS and SSH_MSG_KEXDH_REPLY package. A detected error did not set the session into the error state correctly and further processed the packet which leads to a NULL pointer dereference. This is the packet after the initial key exchange and doesn't require authentication.

This could be used for a Denial of Service (DoS) attack.

ID	Name	Product	Family	Severity
88930	Ubuntu 14.04 LTS : libssh vulnerabilities (USN-2912-1)	Nessus	Ubuntu Local Security Checks	medium
86346	SUSE SLED12 Security Update : libssh (SUSE-SU-2015:1707-2)	Nessus	SuSE Local Security Checks	high
84750	Fedora 22 : libssh-0.7.1-1.fc22 (2015-10962)	Nessus	Fedora Local Security Checks	high
83478	Fedora 21 : libssh-0.6.5-1.fc21 (2015-7590)	Nessus	Fedora Local Security Checks	high
83394	openSUSE Security Update : libssh (openSUSE-2015-355)	Nessus	SuSE Local Security Checks	high
83328	FreeBSD : libssh -- NULL pointer dereference (0b040e24-f751-11e4-b24d-5453ed2e2b49)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-3146

high

Tenable Plugins

medium

high

high

high

high

high