PT-2016-4413 · Libssh2+4 · Libssh2+4

Andreas Schneider · Published 2016-02-23 · Updated 2024-06-15 · CVE-2016-0787

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.7.0

Description The issue arises from a "bits/bytes confusion bug" in the diffie hellman sha256 function, which improperly truncates secrets to 128 or 256 bits. This makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions.

Recommendations For versions prior to 1.7.0, update to version 1.7.0 or later to resolve the issue. As a temporary workaround, consider restricting SSH sessions to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2018-2261

CESA-2016_0428

CVE-2016-0787

DLA-426-1

DSA-3487-1

MGASA-2016-0392

OPENSUSE-SU-2024:10190-1

RHSA-2016:0428

RHSA-2016_0428

SUSE-SU-2016:0718-1

SUSE-SU-2016:0723-1

SUSE-SU-2016_0718-1

SUSE-SU-2016_0723-1

SUSE-SU-2017:2699-1

SUSE-SU-2017:2700-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Libssh2

References · 59

• https://ubuntu.com/security/CVE-2016-0787 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-0787 · Vendor Advisory
• https://libssh2.org/adv_20160223.html · Vendor Advisory
• https://debian.org/security/2016/dsa-3487 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-03/msg00008.html · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2018-2261 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0392.html · Security Note
• https://security-tracker.debian.org/tracker/source-package/libssh2 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178573.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-0787 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-0787 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-0787 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0392 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:0723-1 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177980.html · Vendor Advisory