[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    Re: [oss-security] [SECURITY ADVISORIES] libssh2
From:       Riccardo Schirone <rschiron () redhat ! com>
Date:       2019-03-19 8:44:54
Message-ID: 20190319084454.GA29714 () fedorawork
[Download RAW message or body]


Hello,

On 03/18, Daniel Stenberg wrote:
> Hello!
> 
> CVE-2019-3863
>  Integer overflow in user authenicate keyboard interactive allows
>  out-of-bounds writes
>  URL: https://www.libssh2.org/CVE-2019-3863.html
>  Patch: https://libssh2.org/1.8.0-CVE/CVE-2019-3863.txt
> 

From the security advisory:
> A server could send a multiple keyboard interactive response messages whose
> total length are greater than unsigned char max characters. This value is
> used as an index to copy memory causing in an out of bounds memory write
> error.

Is this really a security issue? It seems to me the server cannot change what
the interactive keyboard message responses contain. They are, after all,
"interactive keyboard messages", thus coming from the user sitting in front of
the client system.

I can see 3 different "response_callback" functions being used to construct
the responses and in one of them it is probably possible to trigger the
overflow, however it would be caused by the user himself. If we assume the
interactive user should not be able to execute code, I'd say the flaw does not
have a remote attack vector but only local.

Did I miss anything?

Thanks,
-- 
Riccardo Schirone
Red Hat -- Product Security
Email: rschiron@redhat.com
PGP-Key ID: CF96E110

["signature.asc" (application/pgp-signature)]

[prev in list] [next in list] [prev in thread] [next in thread]