Integer overflow in libssh2 - CVE-2019-17498

Vulnerability identifier: #VU22574

CSH Severity: High

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-17498

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack or access sensitive information.

The vulnerability exists due to integer overflow in the "SSH_MSG_DISCONNECT" logic in "packet.c" in a bounds check. A remote attacker can specify an arbitrary (out-of-bounds) offset for a subsequent memory read, trigger out-of-bounds read, disclose sensitive information or cause a denial of service condition on the target system when a user connects to the malicious SSH server.

libssh2
Red Hat OpenShift Container Platform
Ansible Automation Platform
Oracle Life Sciences InForm Publisher
Oracle Life Sciences InForm
libssh2 (Alpine package)
libssh2 (Red Hat package)
libssh2
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
Opensuse
Fedora
IBM Tivoli Storage Manager
SmartFabric OS10
Enterprise SONiC
Data Computing Appliance (DCA)
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)
RecoverPoint for VMs
RSA Authentication Manager

Install update from vendor's website.

Ansible Automation Platform - addressed in versions 1.0, 1.1, 1.2.4
libssh2 (Red Hat package) - update to 1.8.0-4.el7
SmartFabric OS10 - update to 10.5.4.11
libssh2 - addressed in versions 1.9.0-3.fc30, 1.9.0-3.fc31
Enterprise SONiC - update to 4.1.2
Data Computing Appliance (DCA) - update to 4.3.0.0
Red Hat OpenShift Container Platform - update to 4.3.40
Dell EMC Unity Operating Environment (OE) - update to 5.0.3.0.5.014
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.3.0.5.014
RecoverPoint for VMs - update to 6.0.SP1.P1
RSA Authentication Manager - update to 8.4 Patch 9

• https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/
• https://github.com/kevinbackhouse/SecurityExploits/tree/8cbdbbe6363510f7d9ceec685373da12e6fc752d/libssh2/out_of_bounds_read_disconnect_CVE-2019-17498
• https://github.com/libssh2/libssh2/blob/42d37aa63129a1b2644bf6495198923534322d64/src/packet.c#L480
• https://github.com/libssh2/libssh2/pull/402/commits/1c6fa92b77e34d089493fe6d3e2c6c8775858b94
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TY7EEE34RFKCTXTMBQQWWSLXZWSCXNDB/

• Integer overflow in libssh2
• OpenSUSE Linux update for libssh2_org
• Integer overflow in libssh2 (Alpine package)
• Red Hat Enterprise Linux 7 update for libssh2
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 1.2
• Integer overflow in Oracle Life Sciences InForm Publisher
• Integer overflow in Oracle Life Sciences InForm
• Multiple vulnerabilities in Dell EMC Enterprise SONiC
• Multiple vulnerabilities in Dell SmartFabric OS10
• Multiple vulnerabilities in Dell RecoverPoint for Virtual Machines
• Multiple vulnerabilities in Ansible Automation Platform 1.0 packages
• Multiple vulnerabilities in Ansible Automation Platform 1.1 packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.3
• Fedora 31 update for libssh2
• Fedora 30 update for libssh2
• RSA Authentication Manager update for third-party components
• Dell EMC Unity update for third-party components