Published: 13/04/2016 Updated: 20/04/2016

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c in libssh prior to 0.6.5 do not properly validate state, which allows remote malicious users to cause a denial of service (NULL pointer dereference and crash) via a crafted SSH packet.

Vulnerable Product	Search on Vulmon	Subscribe to Product
libssh libssh
canonical ubuntu linux 12.04
canonical ubuntu linux 15.10
canonical ubuntu linux 14.04
debian debian linux 8.0
debian debian linux 7.0
fedoraproject fedora 21
fedoraproject fedora 22

Debian Bug report logs - #784404 libssh: CVE-2015-3146: null pointer dereference due to a logical error in the handling of a SSH_MSG_NEWKEYS and KEXDH_REPLY packets Package: src:libssh; Maintainer for src:libssh is Laurent Bigonville <bigon@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, ...

Several security issues were fixed in libssh ...

Aris Adamantiadis discovered that libssh, a tiny C SSH library, incorrectly generated a short ephemeral secret for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods The resulting secret is 128 bits long, instead of the recommended sizes of 1024 and 2048 bits respectively This flaw could allow an eavesdropper with enough re ...

The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cbc in libssh before 065 do not properly validate state, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted SSH packet ...

Publicly disclosed vulnerabilities I discovered in open source software

Security Advisories Upstream (libssh2) Security Advisory - Using SSH_MSG_KEXINIT data unbounded (CVE-2015-1782) Upstream (libssh) Security Advisory - Possible double free on a dangling pointer with crafted kexinit packet (CVE-2015-3146) MZET-ADV-2017-01 - Multiple memory corruption issues in Artifex MuPDF ver 1120 (CVE-2017-17858)

NVD-CWE-Other http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158013.html https://www.libssh.org/security/advisories/CVE-2015-3146.txt https://www.libssh.org/2015/04/30/libssh-0-6-5-security-and-bugfix-release/http://www.ubuntu.com/usn/USN-2912-1 https://git.libssh.org/projects/libssh.git/commit/?h=libssh-0.6.5&id=94f6955fbaee6fda9385a23e505497efe21f5b4f http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161802.html http://www.debian.org/security/2016/dsa-3488 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=784404 https://usn.ubuntu.com/2912-1/https://nvd.nist.gov

CVE-2015-3146

Vulnerability Summary

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect