CVE-2019-13115

In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.

In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.

In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.

• SECURITY UPDATE: integer overflow in transport read allowing out-of-bounds write via crafted SSH packet
  • debian/patches/CVE-2019-3855.patch: add packet_length bounds check against LIBSSH2_PACKET_MAXPAYLOAD in transport read
  • CVE-2019-3855
• SECURITY UPDATE: integer overflow in keyboard-interactive handling allowing out-of-bounds write via crafted num-prompts value
  • debian/patches/CVE-2019-3856.patch: cap num_prompts at 100 to prevent excessive allocation in keyboard-interactive auth
  • CVE-2019-3856
• SECURITY UPDATE: integer overflow in keyboard-interactive response allowing out-of-bounds write via crafted response lengths
  • debian/patches/CVE-2019-3863.patch: add SIZE_MAX overflow check in keyboard-interactive response packet length calculation
  • CVE-2019-3863
• SECURITY UPDATE: out-of-bounds memory access in kex exchange when reading malformed data in diffie_hellman_sha1/sha256
  • debian/patches/CVE-2019-13115.patch: add _libssh2_copy_string() bounds-checked helper and use it in kex DH group exchange
  • CVE-2019-13115

• CVE-2019-13115: add bounds-checked string_buf helpers and use them in diffie_hellman_sha1() to prevent out-of-bounds read on malformed KEX reply
• CVE-2019-17498: harden bounds checks in SSH_MSG_DISCONNECT, SSH_MSG_DEBUG and SSH_MSG_GLOBAL_REQUEST handlers to prevent integer overflow / out-of-bounds read

It was discovered that libssh2 mishandled certain input. If libssh2 were used to connect to a malicious or compromised SSH server, a remote, unauthenticated attacker could possibly execute arbitrary code on the client system. (CVE-2019-3855)

It was discovered that libssh2 incorrectly handled prompt requests. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2019-3856)

It was discovered that libssh2 incorrectly handled SSH_MSG_CHANNEL_REQUEST packets. A remote attacker could possibly use this issue to execute arbitrary code, cause a denial of service, or obtain sensitive information. (CVE-2019-3857, CVE-2019-3862)

It was discovered that libssh2 incorrectly handled specially crafted SFTP packets. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-3858)

It was discovered that libssh2 incorrectly handled certain specially crafted packets. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-3859)

It was discovered that libssh2 incorrectly handled SFTP packets with empty payloads. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-3860)

It was discovered that libssh2 incorrectly handled padding values in SSH packets. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-3861)

It was discovered that libssh2 incorrectly handled interactive response messages length. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2019-3863)

It was discovered that libssh2 incorrectly handled the Diffie Hellman key exchange. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-13115)

It was discovered that libssh2 incorrectly handled bound checks in SSH_MSG_DISCONNECT. A remote attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2019-17498)