A newly announced vulnerability in libssh, a multiplatform library that supports the Secure Shell (SSH) protocol, allows attackers to bypass authentication and gain full control over vulnerable servers.

libssh Vulnerable to Authentication Bypass (CVE-2018-10933)

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.

The remote NewStart CGSL host, running version MAIN 6.02, has libssh packages installed that are affected by multiple vulnerabilities:

  - The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state     of the OpenSSL pseudo-random number generator (PRNG), which causes the state to be shared between children     processes and allows local users to obtain sensitive information by leveraging a pid collision.
    (CVE-2014-0017)

  - A vulnerability was found in libssh's server-side state machine. A malicious client could create channels     without first performing authentication, resulting in unauthorized access. (CVE-2018-10933)

  - A flaw was found with the libssh API function ssh_scp_new(). A user able to connect to a server using SCP     could execute arbitrary command using a user-provided path, leading to a compromise of the remote target.
    (CVE-2019-14889)

  - A flaw was found in libssh. A NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.
    (CVE-2020-16135)

  - A flaw was found in the way libssh handled AES-CTR (or DES ciphers if enabled) ciphers. The server or     client could crash when the connection hasn't been fully initialized and the system tries to cleanup the     ciphers when closing the connection. The biggest threat from this vulnerability is system availability.
    (CVE-2020-1730)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

libssh versions 0.6 and above have an authentication bypass vulnerability in the server code. By presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication, the attacker could successfully authenticate without any credentials.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

According to the version of the libssh package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A vulnerability was found in libssh's server-side state     machine before versions 0.7.6 and 0.8.4. A malicious     client could create channels without first performing     authentication, resulting in unauthorized     access.(CVE-2018-10933)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libssh fixes the following issues :

  - CVE-2018-10933: Fixed a server mode authentication     bypass (bsc#1108020).

This update was imported from the SUSE:SLE-15:Update update project.

Update to version 0.8.4 to address CVE-2018-10933

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to version 0.8.4 to fix CVE-2018-10933

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libssh fixes the following issues :

CVE-2018-10933: Fixed a server mode authentication bypass (bsc#1108020).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-3795-1 fixed a vulnerability in libssh. This update provides the corresponding update for Ubuntu 18.10.

Peter Winter-Smith discovered that libssh incorrectly handled authentication when being used as a server. A remote attacker could use this issue to bypass authentication without any credentials.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libssh fixes the following issues :

Security issue fixed :

CVE-2018-10933: Fixed a server mode authentication bypass (bsc#1108020).

Non security issue fixed: Fix popd syntax to be compatible with newer versions of the bash shell.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libssh fixes the following security issue :

  - CVE-2018-10933: Fixed a server mode authentication     bypass (boo#1108020).

This update was imported from the SUSE:SLE-12:Update update project.

Update to version 0.7.6 to address CVE-2018-10933

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Peter Winter-Smith of NCC Group discovered that libssh, a tiny C SSH library, contains an authentication bypass vulnerability in the server code. An attacker can take advantage of this flaw to successfully authenticate without any credentials by presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication.

For Debian 8 'Jessie', this problem has been fixed in version 0.6.3-4+deb8u3.

We recommend that you upgrade your libssh packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3795-1 advisory.

    Peter Winter-Smith discovered that libssh incorrectly handled authentication when being used as a server.
    A remote attacker could use this issue to bypass authentication without any credentials.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

gladiac reports :

libssh versions 0.6 and above have an authentication bypass vulnerability in the server code. By presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication, the attacker could successfully authentciate without any credentials.

Peter Winter-Smith of NCC Group discovered that libssh, a tiny C SSH library, contains an authentication bypass vulnerability in the server code. An attacker can take advantage of this flaw to successfully authenticate without any credentials by presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication.

New libssh packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix a security issue.

According to its banner version, the remote libssh based server is vulnerable to an authentication bypass.  An attacker can bypass authentication by presenting a SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST method that normally would initiate authentication.

Note that Nessus did not actually test for the flaw but instead has relied on the version in the libssh banner so this may be a false positive.

The remote ssh server is vulnerable to an authentication bypass. An attacker can bypass authentication by presenting SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST method that normally would initiate authentication.

Note: This vulnerability was disclosed in a libssh advisory but has also been observed as applicable to other applications and software packages.

ID	Name	Product	Family	Severity
206832	NewStart CGSL MAIN 6.02 : libssh Multiple Vulnerabilities (NS-SA-2024-0052)	Nessus	NewStart CGSL Local Security Checks	critical
502173	Westermo xRD Products Authentication Bypass (CVE-2018-10933)	Tenable OT Security	Tenable.ot	critical
129260	EulerOS 2.0 SP3 : libssh (EulerOS-SA-2019-2067)	Nessus	Huawei Local Security Checks	critical
123341	openSUSE Security Update : libssh (openSUSE-2019-806)	Nessus	SuSE Local Security Checks	critical
120760	Fedora 28 : libssh (2018-c08cd808d3)	Nessus	Fedora Local Security Checks	critical
120502	Fedora 29 : libssh (2018-6b390ceb36)	Nessus	Fedora Local Security Checks	critical
120131	SUSE SLED15 / SLES15 Security Update : libssh (SUSE-SU-2018:3162-1)	Nessus	SuSE Local Security Checks	critical
118325	Ubuntu 18.10 : libssh vulnerability (USN-3795-2)	Nessus	Ubuntu Local Security Checks	critical
118306	SUSE SLED12 Security Update : libssh (SUSE-SU-2018:3253-1)	Nessus	SuSE Local Security Checks	critical
118250	openSUSE Security Update : libssh (openSUSE-2018-1207)	Nessus	SuSE Local Security Checks	critical
118243	Fedora 27 : libssh (2018-bca1c1ab49)	Nessus	Fedora Local Security Checks	critical
118214	Debian DLA-1548-1 : libssh security update	Nessus	Debian Local Security Checks	critical
118200	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : libssh vulnerability (USN-3795-1)	Nessus	Ubuntu Local Security Checks	critical
118191	openSUSE Security Update : libssh (openSUSE-2018-1180)	Nessus	SuSE Local Security Checks	critical
118182	FreeBSD : libssh -- authentication bypass vulnerability (2383767c-d224-11e8-9623-a4badb2f4699)	Nessus	FreeBSD Local Security Checks	critical
118180	Debian DSA-4322-1 : libssh - security update	Nessus	Debian Local Security Checks	critical
118168	Slackware 14.0 / 14.1 / 14.2 / current : libssh (SSA:2018-289-01)	Nessus	Slackware Local Security Checks	critical
118155	libssh 0.6.x / 0.7.x < 0.7.6 / 0.8.x < 0.8.4 Authentication Bypass (Remote Version Check)	Nessus	Misc.	critical
118154	SSH Protocol Authentication Bypass (Remote Exploit Check)	Nessus	Misc.	critical

Detections

Analytics

CVE-2018-10933

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical