N/A

A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them is called secret_hash and the other session_id. Initially, both of them are the same, but after key re-exchange, previous session_id is kept and used as an input to new secret_hash. Historically, both of these buffers had shared length variable, which worked as long as these buffers were same. But the key re-exchange operation can also change the key exchange method, which can be based on hash of different size, eventually creating "secret_hash" of different size than the session_id has. This becomes an issue when the session_id memory is zeroed or when it is used again during second key re-exchange.

N/A

跨界内存写

Libssh 缓冲区错误漏洞

Libssh是Libssh组织的一个用于访问SSH服务的C语言开发包，它能够执行远程命令、文件传输，同时为远程的程序提供安全的传输通道。 libssh 存在缓冲区错误漏洞，该漏洞源于 libssh 允许在密钥重新交换操作中改变密钥交换方法。改变密钥交换方法时，如果采用不同长度的 hash ，将会导致缓冲区错误。

N/A

N/A