[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20190319084454.GA29714@fedorawork>
Date: Tue, 19 Mar 2019 09:44:54 +0100
From: Riccardo Schirone <rschiron@...hat.com>
To: oss-security@...ts.openwall.com
Cc: libssh2 development <libssh2-devel@...l.haxx.se>
Subject: Re: [SECURITY ADVISORIES] libssh2
Hello,
On 03/18, Daniel Stenberg wrote:
> Hello!
>
> CVE-2019-3863
> Integer overflow in user authenicate keyboard interactive allows
> out-of-bounds writes
> URL: https://www.libssh2.org/CVE-2019-3863.html
> Patch: https://libssh2.org/1.8.0-CVE/CVE-2019-3863.txt
>
From the security advisory:
> A server could send a multiple keyboard interactive response messages whose
> total length are greater than unsigned char max characters. This value is
> used as an index to copy memory causing in an out of bounds memory write
> error.
Is this really a security issue? It seems to me the server cannot change what
the interactive keyboard message responses contain. They are, after all,
"interactive keyboard messages", thus coming from the user sitting in front of
the client system.
I can see 3 different "response_callback" functions being used to construct
the responses and in one of them it is probably possible to trigger the
overflow, however it would be caused by the user himself. If we assume the
interactive user should not be able to execute code, I'd say the flaw does not
have a remote attack vector but only local.
Did I miss anything?
Thanks,
--
Riccardo Schirone
Red Hat -- Product Security
Email: rschiron@...hat.com
PGP-Key ID: CF96E110
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
