Out-of-bounds write in libssh2 - CVE-2019-3863

Vulnerability identifier: #VU18254

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-3863

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing total length of multiple keyboard interactive response messages that exceeds the value of unsigned char max characters. A remote attacker can trick the victim to connect to a malicious SSH server, trigger our of bounds write and execute arbitrary code on the system with privileges of the user, running the affected application.

libssh2
Traffix SDC
Arch Linux
Amazon Linux AMI
FortiOS
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power
Slackware Linux
Opensuse
Fedora
libssh2 (Alpine package)
libssh2 (Debian package)
libssh2
BIG-IQ Centralized Management
IBM Tivoli Storage Manager
BIG-IP APM
BIG-IP FPS
BIG-IP GTM
BIG-IP ASM
BIG-IP LTM
BIG-IP AFM
BIG-IP PEM
BIG-IP Analytics
BIG-IP DNS
BIG-IP AAM
BIG-IP Link Controller
BIG-IP
BIG-IP DDHD
BIG-IP SSLO
BIG-IP Advanced WAF
Flex System Chassis Management Module (CMM)
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)
Data Computing Appliance (DCA)
Dell PowerProtect Cyber Recovery

Install updates from vendor's website.

libssh2 - update to 1.8.1
libssh2 (Alpine package) - update to 1.8.1-r0
libssh2 (Debian package) - update to 1.7.0-1+deb9u1
FortiOS - addressed in versions 5.6.11, 6.0.7, 6.2.1
libssh2 - addressed in versions 1.8.1-1.fc28, 1.8.1-1.fc29, 1.8.2-1.fc30
Flex System Chassis Management Module (CMM) - update to 2pet18c-2.5.16c
Data Computing Appliance (DCA) - update to 3.5.4.0
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.0.0.5.116
Dell EMC Unity Operating Environment (OE) - update to 5.0.0.0.5.116
Dell PowerProtect Cyber Recovery - update to 18.1.1.2-8

• https://www.libssh2.org/CVE-2019-3863.html

• Multiple vulnerabilities in libssh2
• Debian update for libssh2
• Arch Linux update for libssh2
• Slackware Linux update for libssh2
• OpenSUSE Linux update for libssh2
• OpenSUSE Linux update for libssh2
• Red Hat update for libssh2
• Red Hat update for libssh2
• Red Hat update for libssh2
• Red Hat update for libssh2
• Red Hat update for libssh2
• Amazon Linux AMI update for libssh2
• FortiOS update for libssh2
• Out-of-bounds write in libssh2 (Alpine package)
• Multiple vulnerabilities in libssh2 component in F5 products
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Multiple vulnerabilities in Dell EMC Cyber Recovery
• Multiple vulnerabilities in Dell EMC Unity Family
• Multiple vulnerabilities in IBM Flex System Chassis Management Module (CMM)
• Fedora 29 update for libssh2
• Fedora 28 update for libssh2
• Fedora 30 update for libssh2
• Red Hat Enterprise Linux 8 update for the virt:rhel module