The publickey_from_privatekey function in libssh before 0.5.4, when no algorithm is matched during negotiations, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a Client: Diffie-Hellman Key Exchange Init packet.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libssh | Libssh | * | 0.5.3 (including) |
| Libssh | Libssh | 0.4.7 (including) | 0.4.7 (including) |
| Libssh | Libssh | 0.4.8 (including) | 0.4.8 (including) |
| Libssh | Libssh | 0.5.0 (including) | 0.5.0 (including) |
| Libssh | Libssh | 0.5.0-rc1 (including) | 0.5.0-rc1 (including) |
| Libssh | Libssh | 0.5.1 (including) | 0.5.1 (including) |
| Libssh | Libssh | 0.5.2 (including) | 0.5.2 (including) |
| Libssh | Ubuntu | devel | * |
| Libssh | Ubuntu | hardy | * |
| Libssh | Ubuntu | lucid | * |
| Libssh | Ubuntu | oneiric | * |
| Libssh | Ubuntu | precise | * |
| Libssh | Ubuntu | quantal | * |
| Libssh | Ubuntu | upstream | * |
References
- http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098065.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098094.html
- http://secunia.com/advisories/51982
- http://www.libssh.org/2013/01/22/libssh-0-5-4-security-release/
- http://www.ubuntu.com/usn/USN-1707-1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/81595
- http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098065.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098094.html
- http://secunia.com/advisories/51982
- http://www.libssh.org/2013/01/22/libssh-0-5-4-security-release/
- http://www.ubuntu.com/usn/USN-1707-1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/81595