In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libssh2: Out-of-bounds reads with specially crafted SFTP packets (CVE-2019-3860)

  - In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an     integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A     remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a     denial of service condition on the client system when a user connects to the server. This is related to an
    _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as     CVE-2019-3855. (CVE-2019-13115)

  - An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and
    _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a     Denial of Service or read data in the client memory. (CVE-2019-3859)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libssh2: Out-of-bounds memory comparison with specially crafted message channel request (CVE-2019-3862)

  - In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an     integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A     remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a     denial of service condition on the client system when a user connects to the server. This is related to an
    _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as     CVE-2019-3855. (CVE-2019-13115)

  - In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow     in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent     memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of     service condition on the client system when a user connects to the server. (CVE-2019-17498)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5308-1 advisory.

    It was discovered that libssh2 mishandled certain input. If libssh2 were used to connect to a malicious or     compromised SSH server, a remote, unauthenticated attacker could possibly execute arbitrary code on the     client

    system. (CVE-2019-3855)

    It was discovered that libssh2 incorrectly handled prompt requests. A remote attacker could possibly use     this issue to execute arbitrary code. (CVE-2019-3856)

    It was discovered that libssh2 incorrectly handled SSH_MSG_CHANNEL_REQUEST packets. A remote attacker     could possibly use this issue to execute arbitrary code, cause a denial of service, or obtain sensitive     information.

    (CVE-2019-3857, CVE-2019-3862)

    It was discovered that libssh2 incorrectly handled specially crafted SFTP packets. A remote attacker could     possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-3858)

    It was discovered that libssh2 incorrectly handled certain specially crafted packets. A remote attacker     could possibly use this issue to cause a denial of service or obtain sensitive information.
    (CVE-2019-3859)

    It was discovered that libssh2 incorrectly handled SFTP packets with empty payloads. A remote attacker     could possibly use this issue to cause a denial of service or obtain sensitive information.
    (CVE-2019-3860)

    It was discovered that libssh2 incorrectly handled padding values in SSH packets. A remote attacker could     possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-3861)

    It was discovered that libssh2 incorrectly handled interactive response messages length. A remote attacker     could possibly use this issue to execute arbitrary code. (CVE-2019-3863)

    It was discovered that libssh2 incorrectly handled the Diffie Hellman key exchange. A remote attacker     could possibly use this issue to cause a denial of service or obtain sensitive information.
    (CVE-2019-13115)

    It was discovered that libssh2 incorrectly handled bound checks in SSH_MSG_DISCONNECT. A remote attacker     could possibly use this issue to cause a denial of service or obtain sensitive information.
    (CVE-2019-17498)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3559 advisory.

  - In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an     integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A     remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a     denial of service condition on the client system when a user connects to the server. This is related to an
    _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as     CVE-2019-3855. (CVE-2019-13115)

  - In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow     in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent     memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of     service condition on the client system when a user connects to the server. (CVE-2019-17498)

  - An issue was discovered in function _libssh2_packet_add in libssh2 1.10.0 allows attackers to access out     of bounds memory. (CVE-2020-22218)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2848 advisory.

  - In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an     integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A     remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a     denial of service condition on the client system when a user connects to the server. This is related to an
    _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as     CVE-2019-3855. (CVE-2019-13115)

  - In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow     in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent     memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of     service condition on the client system when a user connects to the server. (CVE-2019-17498)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the libssh2 package has been released.

A vulnerability was discovered in libssh2 before 1.9.0, `kex_method_diffie_hellman_group_exchange_sha256_key_exchange` in `kex.c` has an integer overflow that could lead to an out-of-bounds write in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

This is related to an `_libssh2_check_length` mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.

This update, to the latest current upstream release 1.9.0, addresses this security issue and also includes a number of other bug fixes and enhancements as described in the package changelog.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199757	RHEL 7 : libssh2 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199738	RHEL 8 : libssh2 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
183694	Ubuntu 16.04 ESM : libssh2 vulnerabilities (USN-5308-1)	Nessus	Ubuntu Local Security Checks	critical
181187	Debian DLA-3559-1 : libssh2 - LTS security update	Nessus	Debian Local Security Checks	high
156173	Debian DLA-2848-1 : libssh2 - LTS security update	Nessus	Debian Local Security Checks	high
129102	Photon OS 3.0: Libssh2 PHSA-2019-3.0-0026	Nessus	PhotonOS Local Security Checks	high
127521	Fedora 30 : libssh2 (2019-9d85600fc7)	Nessus	Fedora Local Security Checks	high
127512	Fedora 29 : libssh2 (2019-5885663621)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2019-13115

high

Tenable Plugins

critical

critical

critical

high

high

high

high

high