CVE-2015-3146

The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c in libssh before 0.6.5 do not properly validate state, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted SSH packet.

Updated libssh packages fix security vulnerability:

libssh versions 0.5.1 and above, but before 0.6.5, have a logical error in the handling of a SSH_MSG_NEWKEYS and SSH_MSG_KEXDH_REPLY package. A detected error did not set the session into the error state correctly and further processed the packet which leads to a null pointer dereference. This is the packet after the initial key exchange and doesn't require authentication. This could be used for a Denial of Service (DoS) attack (CVE-2015-3146).

These are all security issues fixed in the libssh-devel-0.7.2-2.1 package on the GA media of openSUSE Tumbleweed.

The encryption library libssh was updated to fix one security issue.

The following vulnerability was fixed:

• CVE-2015-3146: Unauthenticated remote attackers could crash the server or client with specially crafted packages.

The encryption library libssh was updated to fix one security issue.

The following vulnerability was fixed:

• CVE-2015-3146: Unauthenticated remote attackers could crash the server or client with specially crafted packages.

Mariusz Ziulek discovered that libssh incorrectly handled certain packets. A remote attacker could possibly use this issue to cause libssh to crash, resulting in a denial of service. (CVE-2015-3146)

Aris Adamantiadis discovered that libssh incorrectly generated ephemeral secret keys of 128 bits instead of the recommended 1024 or 2048 bits when using the diffie-hellman-group1 and diffie-hellman-group14 methods. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to view sensitive information. (CVE-2016-0739)