ID CVE-2015-3146
Summary The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c in libssh before 0.6.5 do not properly validate state, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted SSH packet.
References
Vulnerable Configurations
  • Libssh 0.6.4
    cpe:2.3:a:libssh:libssh:0.6.4
  • Canonical Ubuntu Linux 15.10
    cpe:2.3:o:canonical:ubuntu_linux:15.10
  • Canonical Ubuntu Linux 12.04 LTS
    cpe:2.3:o:canonical:ubuntu_linux:12.04:-:-:-:lts
  • Canonical Ubuntu Linux 14.04 LTS (Long-Term Support)
    cpe:2.3:o:canonical:ubuntu_linux:14.04:-:-:-:lts
  • Debian Linux 8.0 (Jessie)
    cpe:2.3:o:debian:debian_linux:8.0
  • Debian Linux 7.0
    cpe:2.3:o:debian:debian_linux:7.0
  • Fedora 22
    cpe:2.3:o:fedoraproject:fedora:22
  • Fedora 21
    cpe:2.3:o:fedoraproject:fedora:21
CVSS
Base: 5.0 (as of 28-04-2016 - 16:01)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
nessus via4
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2015-355.NASL
    description libssh was updated to fix one security issue. The following vulnerability was fixed : - CVE-2015-3146: Specially crafted packages inserted into a connection could have lead to a client or server process crash via a NULL pointer dereference.
    last seen 2019-02-21
    modified 2016-10-13
    plugin id 83394
    published 2015-05-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=83394
    title openSUSE Security Update : libssh (openSUSE-2015-355)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2015-7590.NASL
    description Security fix for CVE-2015-3146 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2016-10-18
    plugin id 83478
    published 2015-05-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=83478
    title Fedora 21 : libssh-0.6.5-1.fc21 (2015-7590)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2912-1.NASL
    description Mariusz Ziulek discovered that libssh incorrectly handled certain packets. A remote attacker could possibly use this issue to cause libssh to crash, resulting in a denial of service. (CVE-2015-3146) Aris Adamantiadis discovered that libssh incorrectly generated ephemeral secret keys of 128 bits instead of the recommended 1024 or 2048 bits when using the diffie-hellman-group1 and diffie-hellman-group14 methods. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to view sensitive information. (CVE-2016-0739). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 88930
    published 2016-02-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=88930
    title Ubuntu 12.04 LTS / 14.04 LTS / 15.10 : libssh vulnerabilities (USN-2912-1)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_0B040E24F75111E4B24D5453ED2E2B49.NASL
    description Andreas Schneider reports : libssh versions 0.5.1 and above have a logical error in the handling of a SSH_MSG_NEWKEYS and SSH_MSG_KEXDH_REPLY package. A detected error did not set the session into the error state correctly and further processed the packet which leads to a NULL pointer dereference. This is the packet after the initial key exchange and doesn't require authentication. This could be used for a Denial of Service (DoS) attack.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 83328
    published 2015-05-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=83328
    title FreeBSD : libssh -- NULL pointer dereference (0b040e24-f751-11e4-b24d-5453ed2e2b49)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2015-10962.NASL
    description Update to version 0.7.1 Add patch to fix undefined symbol: ssh_forward_listen (bug #1221310) Update to version 0.7.0 Security fix for CVE-2015-3146 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2016-10-18
    plugin id 84750
    published 2015-07-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=84750
    title Fedora 22 : libssh-0.7.1-1.fc22 (2015-10962)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2015-1707-2.NASL
    description The encryption library libssh was updated to fix one security issue. The following vulnerability was fixed : - CVE-2015-3146: Unauthenticated remote attackers could crash the server or client with specially crafted packages. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-29
    plugin id 86346
    published 2015-10-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=86346
    title SUSE SLED12 Security Update : libssh (SUSE-SU-2015:1707-2)
refmap via4
confirm
debian DSA-3488
fedora
  • FEDORA-2015-10962
  • FEDORA-2015-7590
ubuntu USN-2912-1
Last major update 20-04-2016 - 11:07
Published 13-04-2016 - 13:59
Back to Top