In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1755-1 advisory.

  - Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to     exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted     USB device masquerading as a security token on a computer where the affected library is currently in use.
    It is not possible to perform this attack with a genuine YubiKey. (CVE-2018-20340)

  - In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized     stack memory back to the device. (CVE-2019-9578)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libu2f-host fixes the following issues :

This update ships the u2f-host package (jsc#ECO-3687 bsc#1184648)

Version 1.1.10 (released 2019-05-15)

  - Add new devices to udev rules.

  - Fix a potentially uninitialized buffer (CVE-2019-9578,     bsc#1128140)

Version 1.1.9 (released 2019-03-06)

  - Fix CID copying from the init response, which broke     compatibility with some devices.

Version 1.1.8 (released 2019-03-05)

  - Add udev rules

  - Drop 70-old-u2f.rules and use 70-u2f.rules for     everything

  - Use a random nonce for setting up CID to prevent     fingerprinting

  - CVE-2019-9578: Parse the response to init in a more     stable way to prevent leakage of uninitialized stack     memory back to the device (bsc#1128140).

Version 1.1.7 (released 2019-01-08)

  - Fix for trusting length from device in device init.

  - Fix for buffer overflow when receiving data from device.
    (YSA-2019-01, CVE-2018-20340, bsc#1124781)

  - Add udev rules for some new devices.

  - Add udev rule for Feitian ePass FIDO 

  - Add a timeout to the register and authenticate actions.
    This update was imported from the SUSE:SLE-15:Update     update project.

This update for libu2f-host fixes the following issues :

This update ships the u2f-host package (jsc#ECO-3687 bsc#1184648)

Version 1.1.10 (released 2019-05-15)

Add new devices to udev rules.

Fix a potentially uninitialized buffer (CVE-2019-9578, bsc#1128140)

Version 1.1.9 (released 2019-03-06)

Fix CID copying from the init response, which broke compatibility with some devices.

Version 1.1.8 (released 2019-03-05)

Add udev rules

Drop 70-old-u2f.rules and use 70-u2f.rules for everything

Use a random nonce for setting up CID to prevent fingerprinting

CVE-2019-9578: Parse the response to init in a more stable way to prevent leakage of uninitialized stack memory back to the device (bsc#1128140).

Version 1.1.7 (released 2019-01-08)

Fix for trusting length from device in device init.

Fix for buffer overflow when receiving data from device. (YSA-2019-01, CVE-2018-20340, bsc#1124781)

Add udev rules for some new devices.

Add udev rule for Feitian ePass FIDO

  - Add a timeout to the register and authenticate actions.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202004-15 (libu2f-host: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libu2f-host. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to plug-in a malicious USB device,       possibly resulting in execution of arbitrary code with the privileges of       the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for libu2f-host and pam_u2f to version 1.0.8 fixes the following issues :

Security issues fixed for libu2f-host :

  - CVE-2019-9578: Fixed a memory leak due to a wrong parse     of init's response (bsc#1128140).

Security issues fixed for pam_u2f :

  - CVE-2019-12209: Fixed an issue where symlinks in the     user's directory were followed (bsc#1135729).

  - CVE-2019-12210: Fixed file descriptor leaks     (bsc#1135727).

This update was imported from the SUSE:SLE-15:Update update project.

This update for libu2f-host and pam_u2f to version 1.0.8 fixes the following issues :

Security issues fixed for libu2f-host :

CVE-2019-9578: Fixed a memory leak due to a wrong parse of init's response (bsc#1128140).

Security issues fixed for pam_u2f: CVE-2019-12209: Fixed an issue where symlinks in the user's directory were followed (bsc#1135729).

CVE-2019-12210: Fixed file descriptor leaks (bsc#1135727).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libu2f-host and pam_u2f to version 1.0.8 fixes the following issues :

Security issues fixed for libu2f-host :

CVE-2019-9578: Fixed a memory leak due to a wrong parse of init's response (bsc#1128140).

CVE-2018-20340: Fixed an unchecked buffer, which could allow a buffer overflow with a custom made malicious USB device (bsc#1124781).

Security issues fixed for pam_u2f: CVE-2019-12209: Fixed an issue where symlinks in the user's directory were followed (bsc#1135729).

CVE-2019-12210: Fixed file descriptor leaks (bsc#1135727).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2019-9578

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
151710	openSUSE 15 Security Update : libu2f-host (openSUSE-SU-2021:1755-1)	Nessus	SuSE Local Security Checks	medium
150098	openSUSE Security Update : libu2f-host (openSUSE-2021-799)	Nessus	SuSE Local Security Checks	medium
149976	SUSE SLED15 / SLES15 Security Update : libu2f-host (SUSE-SU-2021:1755-1)	Nessus	SuSE Local Security Checks	medium
136214	GLSA-202004-15 : libu2f-host: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
126889	openSUSE Security Update : libu2f-host / pam_u2f (openSUSE-2019-1725)	Nessus	SuSE Local Security Checks	high
126883	openSUSE Security Update : libu2f-host / pam_u2f (openSUSE-2019-1708)	Nessus	SuSE Local Security Checks	high
126502	SUSE SLED15 / SLES15 Security Update : libu2f-host, pam_u2f (SUSE-SU-2019:1750-1)	Nessus	SuSE Local Security Checks	high
126501	SUSE SLED12 / SLES12 Security Update : libu2f-host (SUSE-SU-2019:1749-1)	Nessus	SuSE Local Security Checks	high
124559	Fedora 30 : libu2f-host (2019-fe6d1fbffa)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2019-9578

high

Tenable Plugins

medium

medium

medium

medium

high

high

high

high

high