[gentoo-announce] [ GLSA 201402-26 ] libssh: Arbitrary code execution - gentoo-announce

From:	Chris Reffett <creffett@g.o>
To:	gentoo-announce@g.o
Subject:	[gentoo-announce] [ GLSA 201402-26 ] libssh: Arbitrary code execution
Date:	Fri, 21 Feb 2014 16:23:52
Message-Id:	`53077B7E.6020409@gentoo.org`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 201402-26

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                            http://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: Normal

8

    Title: libssh: Arbitrary code execution

9

     Date: February 21, 2014

10

     Bugs: #444147

11

       ID: 201402-26

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities have been found in libssh, allowing attackers

19

to execute arbitrary code or cause Denial of Service.

20

21

Background

22

==========

23

24

libssh is a C library providing SSHv2 and SSHv1.

25

26

Affected packages

27

=================

28

29

    -------------------------------------------------------------------

30

     Package              /     Vulnerable     /            Unaffected

31

    -------------------------------------------------------------------

32

  1  net-libs/libssh              < 0.5.3                    >= 0.5.3

33

34

Description

35

===========

36

37

Multiple buffer overflow, double free, and integer overflow

38

vulnerabilities have been discovered in libssh.

39

40

Impact

41

======

42

43

A remote attacker could possibly execute arbitrary code with the

44

privileges of the process or cause a Denial of Service condition.

45

46

Workaround

47

==========

48

49

There is no known workaround at this time.

50

51

Resolution

52

==========

53

54

All libssh users should upgrade to the latest version:

55

56

  # emerge --sync

57

  # emerge --ask --oneshot --verbose ">=net-libs/libssh-0.5.3"

58

59

References

60

==========

61

62

[ 1 ] CVE-2012-4559

63

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4559

64

[ 2 ] CVE-2012-4560

65

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4560

66

[ 3 ] CVE-2012-4561

67

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4561

68

[ 4 ] CVE-2012-4562

69

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4562

70

[ 5 ] CVE-2012-6063

71

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6063

72

73

Availability

74

============

75

76

This GLSA and any updates to it are available for viewing at

77

the Gentoo Security Website:

78

79

 http://security.gentoo.org/glsa/glsa-201402-26.xml

80

81

Concerns?

82

=========

83

84

Security is a primary focus of Gentoo Linux and ensuring the

85

confidentiality and security of our users' machines is of utmost

86

importance to us. Any security concerns should be addressed to

87

security@g.o or alternatively, you may file a bug at

88

https://bugs.gentoo.org.

89

90

License

91

=======

92

93

Copyright 2014 Gentoo Foundation, Inc; referenced text

94

belongs to its owner(s).

95

96

The contents of this document are licensed under the

97

Creative Commons - Attribution / Share Alike license.

98

99

http://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 201402-26
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	http://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: Normal
8	Title: libssh: Arbitrary code execution
9	Date: February 21, 2014
10	Bugs: #444147
11	ID: 201402-26
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities have been found in libssh, allowing attackers
19	to execute arbitrary code or cause Denial of Service.
20
21	Background
22	==========
23
24	libssh is a C library providing SSHv2 and SSHv1.
25
26	Affected packages
27	=================
28
29	-------------------------------------------------------------------
30	Package / Vulnerable / Unaffected
31	-------------------------------------------------------------------
32	1 net-libs/libssh < 0.5.3 >= 0.5.3
33
34	Description
35	===========
36
37	Multiple buffer overflow, double free, and integer overflow
38	vulnerabilities have been discovered in libssh.
39
40	Impact
41	======
42
43	A remote attacker could possibly execute arbitrary code with the
44	privileges of the process or cause a Denial of Service condition.
45
46	Workaround
47	==========
48
49	There is no known workaround at this time.
50
51	Resolution
52	==========
53
54	All libssh users should upgrade to the latest version:
55
56	# emerge --sync
57	# emerge --ask --oneshot --verbose ">=net-libs/libssh-0.5.3"
58
59	References
60	==========
61
62	[ 1 ] CVE-2012-4559
63	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4559
64	[ 2 ] CVE-2012-4560
65	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4560
66	[ 3 ] CVE-2012-4561
67	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4561
68	[ 4 ] CVE-2012-4562
69	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4562
70	[ 5 ] CVE-2012-6063
71	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6063
72
73	Availability
74	============
75
76	This GLSA and any updates to it are available for viewing at
77	the Gentoo Security Website:
78
79	http://security.gentoo.org/glsa/glsa-201402-26.xml
80
81	Concerns?
82	=========
83
84	Security is a primary focus of Gentoo Linux and ensuring the
85	confidentiality and security of our users' machines is of utmost
86	importance to us. Any security concerns should be addressed to
87	security@g.o or alternatively, you may file a bug at
88	https://bugs.gentoo.org.
89
90	License
91	=======
92
93	Copyright 2014 Gentoo Foundation, Inc; referenced text
94	belongs to its owner(s).
95
96	The contents of this document are licensed under the
97	Creative Commons - Attribution / Share Alike license.
98
99	http://creativecommons.org/licenses/by-sa/2.5