PT-2018-2669 · Libssh2+5 · Libssh2+5
Chris Coulson
·
Publicado
2018-12-03
·
Atualizado
2024-06-15
·
CVE-2019-3857
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
libssh2 versions prior to 1.8.1
Description
The issue is related to an integer overflow flaw in the way SSH MSG CHANNEL REQUEST packets with an exit signal are parsed. This could lead to an out of bounds write, allowing a remote attacker who compromises a SSH server to potentially execute code on the client system when a user connects to the server. The vulnerability can be exploited by a remote attacker to execute arbitrary code in the client system upon connection to the server.
Recommendations
For libssh2 versions prior to 1.8.1, update to version 1.8.1 or later to resolve the issue. As a temporary workaround, consider restricting access to SSH servers until the update can be applied.
Exploit
Correção
Integer Overflow
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Red Hat
Suse
Ubuntu
Libssh2