The version of F5 Networks BIG-IP installed on the remote host is prior to 16.1.0. It is, therefore, affected by multiple vulnerabilities as referenced in the K90011301 advisory.

    CVE-2019-3856An integer overflow flaw, which could lead to an out of bounds write, was discovered in     libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a     SSH server may be able to execute code on the client system when a user connects to the     server.CVE-2019-3857An integer overflow flaw which could lead to an out of bounds write was discovered in     libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote     attacker who compromises a SSH server may be able to execute code on the client system when a user     connects to the server.CVE-2019-3863A flaw was found in libssh2 before 1.8.1. A server could send a     multiple keyboard interactive response messages whose total length are greater than unsigned char max     characters. This value is used as an index to copy memory causing in an out of bounds memory write     error.ImpactFor CVE-2019-3856 and CVE-2019-3857, a remote attacker may be able to execute code on the     client system when a user connects to the server.For CVE-2019-3863, an attacker may be able to initiate a     response from the server in which the message length causes an out-of-bounds memory write.

Tenable has extracted the preceding description block directly from the F5 Networks BIG-IP security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

F5 Networks BIG-IP : libssh2 vulnerabilities (K90011301)

high Nessus Plugin ID 154888

Version 1.7

Version 1.6

Version 1.5

Version 1.5

Version 1.4

Version 1.7 Mar 27, 2025, 11:10 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202503271110
Version 1.6 Jan 3, 2024, 12:24 PM Plugin metadata Plugin Feed: 202401031224
Version 1.5 Nov 30, 2023, 5:50 AM Detection (updated detection logic) Plugin Feed: 202311300550
Version 1.5 Jan 3, 2024, 10:35 AM Plugin metadata Plugin Feed: 202401031035
Version 1.4 Nov 3, 2023, 7:56 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202311030756