An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.
Se ha descubierto un error de desbordamiento de enteros que podría conducir a una escritura fuera de límites en libssh2, en versiones anteriores a la 1.8.1, en la forma en la que se analizan los paquetes SSH_MSG_CHANNEL_REQUEST con una señal de salida. Un atacante remoto que comprometa un servidor SSH podría ser capaz de ejecutar código en el sistema del cliente cuando un usuario se conecta al servidor.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:N/AC:M/Au:N/C:P/I:P/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-190
en
CWE-787
|
| [email protected] | Primary |
en
CWE-190
en
CWE-787
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| libssh2 | libssh2 | * | <built-in method update of dict object at 0x7fd3694ea0c0> | Application |
| debian | debian_linux | 8.0 | <built-in method update of dict object at 0x7fd340a3b9c0> | Operating System |
| debian | debian_linux | 9.0 | <built-in method update of dict object at 0x7fd3703611c0> | Operating System |
| netapp | ontap_select_deploy_administration_utility | - | <built-in method update of dict object at 0x7fd340a39c00> | Application |
| opensuse | leap | 15.0 | <built-in method update of dict object at 0x7fd3694eb880> | Operating System |
| opensuse | leap | 42.3 | <built-in method update of dict object at 0x7fd3694e8f00> | Operating System |
| redhat | enterprise_linux | 8.0 | <built-in method update of dict object at 0x7fd342b3bd40> | Operating System |
| redhat | enterprise_linux_desktop | 7.0 | <built-in method update of dict object at 0x7fd36b8fe700> | Operating System |
| redhat | enterprise_linux_server | 7.0 | <built-in method update of dict object at 0x7fd340a3ab40> | Operating System |
| redhat | enterprise_linux_server_aus | 7.6 | <built-in method update of dict object at 0x7fd3694ead00> | Operating System |
| redhat | enterprise_linux_server_eus | 7.6 | <built-in method update of dict object at 0x7fd340a3ad00> | Operating System |
| redhat | enterprise_linux_server_tus | 7.6 | <built-in method update of dict object at 0x7fd340a38e80> | Operating System |
| redhat | enterprise_linux_workstation | 7.0 | <built-in method update of dict object at 0x7fd3855c1700> | Operating System |
| fedoraproject | fedora | 28 | <built-in method update of dict object at 0x7fd3855c0f80> | Operating System |
| oracle | peoplesoft_enterprise_peopletools | 8.56 | <built-in method update of dict object at 0x7fd3855c1840> | Application |
| oracle | peoplesoft_enterprise_peopletools | 8.57 | <built-in method update of dict object at 0x7fd342b38c00> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:advanced_virtualization:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* |