ID CVE-2012-4562
Summary Multiple integer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (infinite loop or crash) and possibly execute arbitrary code via unspecified vectors, which triggers a buffer overflow, infinite loop, or possibly some other unspecified vulnerabilities.
References
Vulnerable Configurations
  • Libssh 0.5.2
    cpe:2.3:a:libssh:libssh:0.5.2
  • Libssh 0.5.1
    cpe:2.3:a:libssh:libssh:0.5.1
  • Libssh 0.5.0
    cpe:2.3:a:libssh:libssh:0.5.0
  • Libssh 0.5.0rc1
    cpe:2.3:a:libssh:libssh:0.5.0:rc1
  • Libssh 0.4.8
    cpe:2.3:a:libssh:libssh:0.4.8
  • Libssh 0.4.7
    cpe:2.3:a:libssh:libssh:0.4.7
CVSS
Base: 7.5 (as of 03-12-2012 - 14:57)
Impact:
Exploitability:
CWE CWE-189
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2012-836.NASL
    description This update of libssh fixed various memory management issues that could have security implications (Code execution, Denial of Service).
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 74829
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74829
    title openSUSE Security Update : libssh (openSUSE-SU-2012:1622-1)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2012-18687.NASL
    description This is an important SECURITY and maintenance release in order to address CVE-2012-4559, CVE-2012-4560, CVE-2012-4561 and CVE-2012-4562. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-20
    plugin id 63173
    published 2012-12-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63173
    title Fedora 16 : libssh-0.5.3-1.fc16 (2012-18687)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2012-840.NASL
    description This update of libssh fixed various memory management issues that could have security implications (Code execution, Denial of Service).
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 74834
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74834
    title openSUSE Security Update : libssh (openSUSE-SU-2012:1620-1)
  • NASL family Slackware Local Security Checks
    NASL id SLACKWARE_SSA_2012-341-02.NASL
    description New libssh packages are available for Slackware 14.0, and -current to fix security issues.
    last seen 2019-02-21
    modified 2013-06-01
    plugin id 63168
    published 2012-12-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63168
    title Slackware 14.0 / current : libssh (SSA:2012-341-02)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_LIBSSH2-121120.NASL
    description This update of libssh fixes multiple integer overflows. CVE-2012-4562 has been assigned to this issue.
    last seen 2019-02-21
    modified 2013-10-25
    plugin id 64196
    published 2013-01-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=64196
    title SuSE 11.2 Security Update : libssh2 (SAT Patch Number 7073)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201402-26.NASL
    description The remote host is affected by the vulnerability described in GLSA-201402-26 (libssh: Arbitrary code execution) Multiple buffer overflow, double free, and integer overflow vulnerabilities have been discovered in libssh. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process or cause a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-12
    plugin id 72640
    published 2014-02-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=72640
    title GLSA-201402-26 : libssh: Arbitrary code execution
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2013-045.NASL
    description Updated libssh packages fix security vulnerabilities : Multiple double free flaws, buffer overflow flaws, invalid free flaws, and improper overflow checks in libssh before 0.5.3 could enable a denial of service attack against libssh clients, or possibly arbitrary code execution (CVE-2012-4559, CVE-2012-4560, CVE-2012-4561 and CVE-2012-4562). Yong Chuan Koh discovered that libssh incorrectly handled certain negotiation requests. A remote attacker could use this to cause libssh to crash, resulting in a denial of service (CVE-2013-0176).
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 66059
    published 2013-04-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66059
    title Mandriva Linux Security Advisory : libssh (MDVSA-2013:045)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-1640-1.NASL
    description Xi Wang and Florian Weimer discovered that libssh incorrectly handled memory. A remote attacker could use this to cause libssh to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2012-4559, CVE-2012-4560, CVE-2012-4561, CVE-2012-4562). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 63058
    published 2012-11-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63058
    title Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : libssh vulnerabilities (USN-1640-1)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-2577.NASL
    description Multiple vulnerabilities were discovered in libssh by Florian Weimer and Xi Wang : - CVE-2012-4559: multiple double free() flaws - CVE-2012-4561: multiple invalid free() flaws - CVE-2012-4562: multiple improper overflow checks Those could lead to a denial of service by making an SSH client linked to libssh crash, and maybe even arbitrary code execution.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 63125
    published 2012-12-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63125
    title Debian DSA-2577-1 : libssh - several vulnerabilities
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2012-175.NASL
    description Multiple double free(), buffer overflow, invalid free() and improper overflow checks vulnerabilities was found and corrected in libssh (CVE-2012-4559, CVE-2012-4560, CVE-2012-4561, CVE-2012-4562). The updated packages have been upgraded to the 0.5.3 version which is not affected by these issues.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 63104
    published 2012-11-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63104
    title Mandriva Linux Security Advisory : libssh (MDVSA-2012:175)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2012-18610.NASL
    description This is an important SECURITY and maintenance release in order to address CVE-2012-4559, CVE-2012-4560, CVE-2012-4561 and CVE-2012-4562. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-20
    plugin id 63054
    published 2012-11-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63054
    title Fedora 18 : libssh-0.5.3-1.fc18 (2012-18610)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2012-18677.NASL
    description This is an important SECURITY and maintenance release in order to address CVE-2012-4559, CVE-2012-4560, CVE-2012-4561 and CVE-2012-4562. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-20
    plugin id 63089
    published 2012-11-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63089
    title Fedora 17 : libssh-0.5.3-1.fc17 (2012-18677)
refmap via4
bid 56604
confirm http://www.libssh.org/2012/11/20/libssh-0-5-3-security-release/
debian DSA-2577
fedora
  • FEDORA-2012-18610
  • FEDORA-2012-18677
mandriva MDVSA-2012:175
misc https://bugzilla.redhat.com/show_bug.cgi?id=871620
mlist [oss-security] 20121120 libssh 0.5.3 release fixes multiple security issues
suse
  • SUSE-SU-2012:1520
  • openSUSE-SU-2012:1620
  • openSUSE-SU-2012:1622
  • openSUSE-SU-2013:0130
ubuntu USN-1640-1
xf libssh-buffer-bo(80221)
Last major update 26-08-2013 - 23:27
Published 30-11-2012 - 17:55
Last modified 28-08-2017 - 21:32
Back to Top