Out-of-bounds read in libssh2 (Alpine package)

1) Out-of-bounds read

EUVDB-ID: #VU18252

Risk: Low

CVSSv3.1: 3.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-3861

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information or perform denial of service (DoS) attack.

The vulnerability exists due to a boundary condition when SSH packets with a padding length value greater than the packet length are parsed. A remote attacker can trick the victim to connect to a malicious SSH server, trigger out of bounds read and gain access to sensitive information or perform denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

libssh2 (Alpine package): 1.3.0-r0 - 1.8.0-r4

External links

http://git.alpinelinux.org/aports/commit/?id=d60ef1f3b3cd3b40d41722b7de616227c0b83a2b
http://git.alpinelinux.org/aports/commit/?id=eec223036af35046c74baca7b09d6a81aaccbe86
http://git.alpinelinux.org/aports/commit/?id=0c38351d5beace23bc498ea5fc79b3ba6a012b6e
http://git.alpinelinux.org/aports/commit/?id=27f813a2ece1924d1c8f2e02239ad214611599fb
http://git.alpinelinux.org/aports/commit/?id=4f69ccce51fcfa18af42948e79d26c5d0ba42733

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.