CVE-2019-3855

Quick assessment

Copy summary Copy citation

Affected

The libssh2 Project libssh2

Exploitation

High exploitation probability; assess promptly

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

libssh2是一款实现SSH2协议的客户端C库，它能够执行远程命令、文件传输，同时为远程的程序提供安全的传输通道。 libssh2中存在输入验证错误漏洞，该漏洞源于_libssh2_transport_read()函数没有正确地检查来自服务器的packet_length值。远程攻击者可利用该漏洞在客户端系统上执行代码。

CVE-2019-3855 affects The libssh2 Project libssh2. High exploitation probability; assess promptly. libssh2是一款实现SSH2协议的客户端C库，它能够执行远程命令、文件传输，同时为远程的程序提供安全的传输通道。 libssh2中存在输入验证错误漏洞，该漏洞源于_libssh2_transport_read()函数没有正确地检查来自服务器的packet_length值。远程攻击者可利用该漏洞在客户端系统上执行代码。 CVE-2019-3855 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2019-3855

I. Basic Information for CVE-2019-3855

Affected Products

II. Public POCs for CVE-2019-3855

III. Intelligence Information for CVE-2019-3855

Vendor Advisories for CVE-2019-3855 (12)

• https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html x_refsource_MISC
• libssh2 Security Advisory: CVE-2019-3855 x_refsource_MISC
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3855 x_refsource_CONFIRM
• https://security.netapp.com/advisory/ntap-20190327-0005/ x_refsource_CONFIRM
• https://support.apple.com/kb/HT210609 x_refsource_CONFIRM
• http://www.securityfocus.com/bid/107485 vdb-entry x_refsource_BID
• https://www.debian.org/security/2019/dsa-4431 vendor-advisory x_refsource_DEBIAN
• https://access.redhat.com/errata/RHSA-2019:2399 vendor-advisory x_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2019:1943 vendor-advisory x_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2019:1652 vendor-advisory x_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2019:1175 vendor-advisory x_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2019:1791 vendor-advisory x_refsource_REDHAT

Exploits & Public PoCs for CVE-2019-3855 (1)

• http://packetstormsecurity.com/files/152136/Slackware-Security-Advisory-libssh2-Updates.html x_refsource_MISC

Mailing List Discussions for CVE-2019-3855 (12)

• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html vendor-advisory x_refsource_SUSE
• http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html vendor-advisory x_refsource_SUSE
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M7IF3LNHOA75O4WZWIHJLIRMA5LJUED3/ vendor-advisory x_refsource_FEDORA
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCWEA5ZCLKRDUK62QVVYMFWLWKOPX3LO/ vendor-advisory x_refsource_FEDORA
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/ vendor-advisory x_refsource_FEDORA
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LUNHPW64IGCASZ4JQ2J5KDXNZN53DWW/ vendor-advisory x_refsource_FEDORA
• https://seclists.org/bugtraq/2019/Sep/49 mailing-list x_refsource_BUGTRAQ
• http://seclists.org/fulldisclosure/2019/Sep/42 mailing-list x_refsource_FULLDISC
• http://www.openwall.com/lists/oss-security/2019/03/18/3 mailing-list x_refsource_MLIST
• https://seclists.org/bugtraq/2019/Mar/25 mailing-list x_refsource_BUGTRAQ
• https://seclists.org/bugtraq/2019/Apr/25 mailing-list x_refsource_BUGTRAQ
• https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html mailing-list x_refsource_MLIST

Other References for CVE-2019-3855 (1)

• https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-767 x_refsource_CONFIRM

• https://www.cve.org/CVERecord?id=CVE-2019-3855

IV. Related Vulnerabilities

V. Comments for CVE-2019-3855