Libssh Releases Update to Patch 9 New Security Vulnerabilities

The Libssh2 library is available for all major distributors of
the Linux operating systems, including Ubuntu, Red Hat, Debian, and
also comes bundled within some distributions and software as a
default library.

According to an advisory published Monday, all the below
listed vulnerabilities that were patched with the release of
libssh2 version 1.8.1 lead to memory corruption issues which could
result in arbitrary code execution on a client system in certain
circumstances.
^[1]

Here’s the list of security vulnerabilities patched in Libssh:

1. CVE-2019-3855: Possible integer overflow in transport
read that could lead to an out-of-bounds write. A malicious server,
or a remote attacker who compromises an SSH server, could send a
specially crafted packet which could result in executing malicious
code on the client system when a user connects to the server.

2. CVE-2019-3856: Possible integer overflow in keyboard
interactive handling allows out-of-bounds write. A malicious or a
compromised SSH server can exploit client system by sending a value
approaching unsigned int max number of keyboard prompt
requests.

3. CVE-2019-3857: Possible integer overflow issue leads
to zero-byte allocation and out-of-bounds write. A malicious server
could send an SSH_MSG_CHANNEL_REQUEST packet with an exit signal
message with a length of max unsigned integer value.

4. CVE-2019-3858: Possible zero-byte allocation leading
to an out-of-bounds. Attacking server can send a specially crafted
partial SFTP packet with a zero value for the payload length,
allowing attackers to cause a Denial of Service or read data in the
client memory.

5. CVE-2019-3859: Out-of-bounds reads with specially
crafted payloads due to unchecked use of “_libssh2_packet_require
and _libssh2_packet_requirev.” A server could send a specially
crafted partial packet in response to various commands such as:
sha1 and sha226 key exchange, user auth list, user auth password
response, allowing attackers to cause a Denial of Service or read
data in the client memory.

6. CVE-2019-3860: Out-of-bounds reads with specially
crafted SFTP packets that also lead to Denial of Service or read
data in the client memory attacks.

7. CVE-2019-3861: Out-of-bounds reads with specially crafted
SSH packets that occurs when the padding length value is greater
than the packet length, resulting in the parsing of the corrupted
packet.

8. CVE-2019-3862: An out of bounds read issue occurs when
the server sends specially crafted SSH_MSG_CHANNEL_REQUEST packets
with an exit status message and no payload, resulting in Denial of
Service or read data in the client memory.

9. CVE-2019-3863: Integer overflow in the user
authenticated keyboard interactive allows out-of-bounds writes.

These security vulnerabilities affect all versions of Libssh2
prior to version 1.8.1, and fortunately, there is reportedly no
known exploits of these flaw at this time on the Internet.

Chris Coulson of Canonical Ltd. was credited for discovering all
the nine security vulnerabilities and responsibly disclosing them
to the Libssh developers.

If you are using Libssh, install the updated version of Libssh
as soon as possible.

This is not the first time when the popular library has been
found vulnerable to security issues. Late last year, its developers
patched a four-year-old
severe vulnerability^[2]
in Libssh that allowed unauthenticated attackers to gain unfettered
administrative control over a vulnerable server without requiring a
password.