Re: [SECURITY ADVISORIES] libssh2

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
Re: [SECURITY ADVISORIES] libssh2

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: Riccardo Schirone &lt;rschiron () redhat com&gt;

Date: Tue, 19 Mar 2019 09:44:54 +0100

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
Hello,

On 03/18, Daniel Stenberg wrote:
Hello!

CVE-2019-3863
 Integer overflow in user authenicate keyboard interactive allows
 out-of-bounds writes
 URL: https://www.libssh2.org/CVE-2019-3863.html
 Patch: https://libssh2.org/1.8.0-CVE/CVE-2019-3863.txt

From the security advisory:
A server could send a multiple keyboard interactive response messages whose
total length are greater than unsigned char max characters. This value is
used as an index to copy memory causing in an out of bounds memory write
error.

Is this really a security issue? It seems to me the server cannot change what
the interactive keyboard message responses contain. They are, after all,
"interactive keyboard messages", thus coming from the user sitting in front of
the client system.

I can see 3 different "response_callback" functions being used to construct
the responses and in one of them it is probably possible to trigger the
overflow, however it would be caused by the user himself. If we assume the
interactive user should not be able to execute code, I'd say the flaw does not
have a remote attack vector but only local.

Did I miss anything?

Thanks,
-- 
Riccardo Schirone
Red Hat -- Product Security
Email: rschiron () redhat com
PGP-Key ID: CF96E110
Attachment:
signature.asc
Description: 

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

[SECURITY ADVISORIES] libssh2 Daniel Stenberg (Mar 18)

Re: [SECURITY ADVISORIES] libssh2 Riccardo Schirone (Mar 19)

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->