This week, NATIONAL VULNERABILITY DATABASE (NVD) identified an integer overflow flaw in libssh2 before the release of version 1.8.1 which could lead to an out of bounds write. A remote attacker could take advantage of this flaw to compromise an SSH server and execute code on the client system when a user connects to the server.
Impact of the flaw in libssh2
The Common Vulnerability Scoring System (CVSS) base score, a numerical score that reflects its severity, calculated by the team who identified the flaw is 8.8, which is high. The overall impact score calculated by the team is 5.9 where the exploitability score is 2.8. The team also identified that the attack vector was a network and the attack complexity was low.
Security issues fixed by the team
CVE-2019-3861: The team fixed out-of-bounds reads with SSH packets.
CVE-2019-3862: The team fixed the issues related to out-of-bounds memory with message channel request packet.
CVE-2019-3860: The team fixed out-of-bounds reads with SFTP packets.
CVE-2019-3863: The team fixed the integer overflow in user authenticate keyboard which could allow out-of-bounds writes with keyboard responses.
CVE-2019-3856: The team fixed the issues related to a potential integer overflow in keyboard handling which could allow out-of-bounds write with payload.
CVE-2019-3859: The team fixed the issues with out-of-bounds reads with payloads because of unchecked use of _libssh2_packet_require and _libssh2_packet_requirev.
CVE-2019-3855: The team fixed a potential Integer overflow in transport read which could allow out-of-bounds write with a payload.
CVE-2019-3858: The issues with the zero-byte allocation have been fixed, which could lead to an out-of-bounds read with SFTP packet.
To know more about this news, check out NVD’s post.