Information disclosure in libssh - CVE-2016-0739

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU32329

Information disclosure in libssh - CVE-2016-0739

Published: April 13, 2016 / Updated: July 28, 2020


Vulnerability identifier: #VU32329
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-0739
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

libssh before 0.7.3 improperly truncates ephemeral secrets generated for the (1) diffie-hellman-group1 and (2) diffie-hellman-group14 key exchange methods to 128 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."


Affected software

libssh
libssh (Alpine package)
libssh
libssh (Red Hat package)
Fedora
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Server from RHUI
Slackware Linux

How to mitigate CVE-2016-0739

Install update from vendor's website.

libssh - update to 0.7.3
libssh (Alpine package) - addressed in versions 0.6.5-r0, 0.6.5-r1
libssh - addressed in versions 0.5.5-5.el6, 0.6.5-2.el7, 0.7.3-1.fc22, 0.7.3-1.fc23
libssh (Red Hat package) - update to 0.7.1-2.el7

External References

Related Security Bulletins