Out-of-bounds read in libssh2 - CVE-2019-3862

Vulnerability identifier: #VU18253

CSH Severity: Medium

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-3862

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information or perform denial of service (DoS) attack.

The vulnerability exists due to a boundary condition when SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker can trick the victim to connect to a malicious SSH server, trigger out of bounds read and gain access to sensitive information or perform denial of service attack.

libssh2
Arch Linux
FortiOS
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power
Slackware Linux
Opensuse
Fedora
libssh2 (Alpine package)
libssh2 (Debian package)
libssh2
IBM Tivoli Storage Manager
Oracle Communications Diameter Signaling Router (DSR)
BIG-IQ Centralized Management
PeopleSoft Enterprise PeopleTools
Oracle Communications User Data Repository
Dell PowerProtect Cyber Recovery
Flex System Chassis Management Module (CMM)
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)

Install update from vendor's website.

libssh2 - update to 1.8.1
libssh2 (Alpine package) - update to 1.8.1-r0
libssh2 (Debian package) - update to 1.7.0-1+deb9u1
FortiOS - addressed in versions 5.6.11, 6.0.7, 6.2.1
libssh2 - addressed in versions 1.8.1-1.fc28, 1.8.1-1.fc29, 1.8.2-1.fc30
Flex System Chassis Management Module (CMM) - update to 2pet18c-2.5.16c
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.0.0.5.116
Dell EMC Unity Operating Environment (OE) - update to 5.0.0.0.5.116
Dell PowerProtect Cyber Recovery - update to 18.1.1.2-8

• https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-767
• https://www.libssh2.org/CVE-2019-3862.html

• Multiple vulnerabilities in libssh2
• Debian update for libssh2
• Arch Linux update for libssh2
• Slackware Linux update for libssh2
• OpenSUSE Linux update for libssh2
• OpenSUSE Linux update for libssh2
• Red Hat update for libssh2
• FortiOS update for libssh2
• Multiple vulnerabilities in Oracle Communications Diameter Signaling Router (DSR)
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Out-of-bounds read in libssh2 (Alpine package)
• Multiple vulnerabilities in Oracle Communications User Data Repository
• Multiple vulnerabilities in Dell EMC Cyber Recovery
• Multiple vulnerabilities in Dell EMC Unity Family
• Multiple vulnerabilities in F5 BIG-IQ Centralized Management libssh2 component
• Multiple vulnerabilities in IBM Flex System Chassis Management Module (CMM)
• Fedora 29 update for libssh2
• Fedora 28 update for libssh2
• Fedora 30 update for libssh2