1. CVE-Search
  2. CVE-2015-3146
ID CVE-2015-3146
Summary The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c in libssh before 0.6.5 do not properly validate state, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted SSH packet. <a href="http://cwe.mitre.org/data/definitions/476.html">CWE-476: NULL Pointer Dereference</a>
References
Vulnerable Configurations
  • cpe:2.3:a:libssh:libssh:0.4.7:*:*:*:*:*:*:*
    cpe:2.3:a:libssh:libssh:0.4.7:*:*:*:*:*:*:*
  • cpe:2.3:a:libssh:libssh:0.4.8:*:*:*:*:*:*:*
    cpe:2.3:a:libssh:libssh:0.4.8:*:*:*:*:*:*:*
  • cpe:2.3:a:libssh:libssh:0.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:libssh:libssh:0.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:libssh:libssh:0.5.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:libssh:libssh:0.5.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:libssh:libssh:0.5.1:*:*:*:*:*:*:*
    cpe:2.3:a:libssh:libssh:0.5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:libssh:libssh:0.5.2:*:*:*:*:*:*:*
    cpe:2.3:a:libssh:libssh:0.5.2:*:*:*:*:*:*:*
  • cpe:2.3:a:libssh:libssh:0.5.3:*:*:*:*:*:*:*
    cpe:2.3:a:libssh:libssh:0.5.3:*:*:*:*:*:*:*
  • cpe:2.3:a:libssh:libssh:0.5.4:*:*:*:*:*:*:*
    cpe:2.3:a:libssh:libssh:0.5.4:*:*:*:*:*:*:*
  • cpe:2.3:a:libssh:libssh:0.5.5:*:*:*:*:*:*:*
    cpe:2.3:a:libssh:libssh:0.5.5:*:*:*:*:*:*:*
  • cpe:2.3:a:libssh:libssh:0.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:libssh:libssh:0.6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:libssh:libssh:0.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:libssh:libssh:0.6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:libssh:libssh:0.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:libssh:libssh:0.6.2:*:*:*:*:*:*:*
  • cpe:2.3:a:libssh:libssh:0.6.3:*:*:*:*:*:*:*
    cpe:2.3:a:libssh:libssh:0.6.3:*:*:*:*:*:*:*
  • cpe:2.3:a:libssh:libssh:0.6.4:*:*:*:*:*:*:*
    cpe:2.3:a:libssh:libssh:0.6.4:*:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*
    cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
    cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 20-04-2016 - 15:07)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:P
refmap via4
confirm
debian DSA-3488
fedora
  • FEDORA-2015-10962
  • FEDORA-2015-7590
ubuntu USN-2912-1
Last major update 20-04-2016 - 15:07
Published 13-04-2016 - 17:59
Last modified 20-04-2016 - 15:07
Back to Top