DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
libssh2: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2019-03-18
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in libssh2 ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen, Informationen offenzulegen oder einen Denial of Service zu verursachen.
01
beschreibt (9)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-3861US | critical9.1 | — | ||
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker wh… | ||||
| CVE-2019-3860US | critical9.1 | — | ||
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able… | ||||
| CVE-2019-3857US | high8.8 | — | ||
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed… | ||||
| CVE-2019-3856US | high8.8 | — | ||
An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who c… | ||||
| CVE-2019-3863US | high8.8 | — | ||
A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length a… | ||||
| CVE-2019-3858US | critical9.1 | — | ||
An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server m… | ||||
| CVE-2019-3855US | high8.8 | — | ||
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compro… | ||||
| CVE-2019-3862US | critical9.1 | — | ||
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacke… | ||||
| CVE-2019-3859US | critical9.1 | — | ||
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH ser… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- CentOS Security Advisory CESA-2019:0679 vom 2019-04-01external
- CentOS-announce CESA-2019:1652 vom 2019-07-03external
- CentOS Security Advisory CESA-2019:1884 vom 2019-07-31external
- Juniper Security Advisory JSA11023 vom 2020-07-08external
- Oracle Linux Security Advisory ELSA-2019-0679 vom 2019-03-28external
- Oracle Linux Security Advisory ELSA-2019-1652 vom 2019-07-03external
- Oracle Linux Security Advisory ELSA-2019-1884 vom 2019-07-30external
- Oracle Linux Security Advisory ELSA-2019-4692 vom 2019-06-21external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan