| Summary: | <net-libs/libssh2-1.5.0: Using SSH_MSG_KEXINIT data unbounded (CVE-2015-1782) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | minor | CC: | netmon |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://www.libssh2.org/adv_20150311.html | ||
| Whiteboard: | B3 [noglsa/cve] | ||
| Package list: | Runtime testing required: | --- | |
Arch teams, please test and mark stable: =net-libs/libssh2-1.5.0 Targeted stable KEYWORDS : alpha amd64 arm hppa ia64 ppc ppc64 sparc x86 Stable for HPPA. amd64 stable x86 stable ia64 stable ppc stable ppc64 stable arm stable CVE-2015-1782 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1782): The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to cause a denial of service (crash) or have other unspecified impact via crafted length values in an SSH_MSG_KEXINIT packet. sparc stable alpha stable. Maintainer(s), please cleanup. Security, please vote. Arches and Maintainer(s), Thank you for your work. GLSA Vote: Yes GLSA vote: No Client DoS => NO, closing. Thanks everyone. |
From ${URL} : The following issue was reported as affecting libssh2: When negotiating a new SSH session with a remote server, one of libssh2's functions for doing the key exchange (kex_agree_methods) was naively reading data from the incoming packet and using it without doing sufficient range checks. The SSH_MSG_KEXINIT packet arrives to libssh2 with a set of strings, sent as a series of LENGTH + DATA pairs. libssh2 would go through the list and read the LENGTH field, read the string following the LENGTH and then advance the pointer LENGTH bytes in memory and expect to find the next LENGTH + DATA pair there. Then move on until seven subsequent strings are taken care of. It would naively assume that the (unsigned 32 bit) LENGTH fields were fine. This packet arrives in the negotiating phase so the remote server has not yet been deemed to be a known or trusted party. A malicious attacker could man in the middle a real server and cause libssh2 using clients to crash (denial of service) or otherwise read and use completely unintended memory areas in this process. There are no known exploits of this flaw at this time. External References: http://www.libssh2.org/adv_20150311.html @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.