Integer overflow in OpenSSH - CVE-2019-16905

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to integer overflow within the XMSS key parsing algorithm. A local user can configure the server or client to use a specially crafted XMSS private key, trigger integer overflow and execute arbitrary code on the target system with elevated privileges.

Affected software

How to mitigate CVE-2019-16905

External References

• https://0day.life/exploits/0day-1009.html
• https://bugzilla.suse.com/show_bug.cgi?id=1153537
• https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c
• https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c.diff?r1=1.5&r2=1.6&f=h
• https://security.netapp.com/advisory/ntap-20191024-0003/
• https://ssd-disclosure.com/archives/4033/ssd-advisory-openssh-pre-auth-xmss-integer-overflow
• https://www.openssh.com/releasenotes.html
• https://www.openwall.com/lists/oss-security/2019/10/09/1

Related Security Bulletins

• Privilege escalation in OpenSSH
• Gentoo update for OpenSSH
• SolarWinds Security Event Manager (SEM) update for third-party components