Date: Tue, 19 Mar 2019 09:44:54 +0100 From: Riccardo Schirone <rschiron@...hat.com> To: oss-security@...ts.openwall.com Cc: libssh2 development <libssh2-devel@...l.haxx.se> Subject: Re: [SECURITY ADVISORIES] libssh2 Hello, On 03/18, Daniel Stenberg wrote: > Hello! > > CVE-2019-3863 > Integer overflow in user authenicate keyboard interactive allows > out-of-bounds writes > URL: https://www.libssh2.org/CVE-2019-3863.html > Patch: https://libssh2.org/1.8.0-CVE/CVE-2019-3863.txt > From the security advisory: > A server could send a multiple keyboard interactive response messages whose > total length are greater than unsigned char max characters. This value is > used as an index to copy memory causing in an out of bounds memory write > error. Is this really a security issue? It seems to me the server cannot change what the interactive keyboard message responses contain. They are, after all, "interactive keyboard messages", thus coming from the user sitting in front of the client system. I can see 3 different "response_callback" functions being used to construct the responses and in one of them it is probably possible to trigger the overflow, however it would be caused by the user himself. If we assume the interactive user should not be able to execute code, I'd say the flaw does not have a remote attack vector but only local. Did I miss anything? Thanks, -- Riccardo Schirone Red Hat -- Product Security Email: rschiron@...hat.com PGP-Key ID: CF96E110 Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.