Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | libssh security update |
| Informations | |||
|---|---|---|---|
| Name | DSA-2577 | First vendor Publication | 2012-12-01 |
| Vendor | Debian | Last vendor Modification | 2012-12-01 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Multiple vulnerabilities were discovered in libssh by Florian Weimer and Xi Wang: CVE-2012-4559: multiple double free() flaws CVE-2012-4561: multiple invalid free() flaws CVE-2012-4562: multiple improper overflow checks Those could lead to a denial of service by making an ssh client linked to libssh crash, and maybe even arbitrary code execution. For the stable distribution (squeeze), these problems have been fixed in version 0.4.5-3+squeeze1. For the testing distribution (wheezy), these problems have been fixed in version 0.5.3-1. For the unstable distribution (sid), these problems have been fixed in version 0.5.3-1. We recommend that you upgrade your libssh packages. |
Original Source
| Url : http://www.debian.org/security/2012/dsa-2577 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 67 % | CWE-399 | Resource Management Errors |
| 33 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:17817 | |||
| Oval ID: | oval:org.mitre.oval:def:17817 | ||
| Title: | DSA-2577-1 libssh - several | ||
| Description: | Multiple vulnerabilities were discovered in libssh by Florian Weimer and Xi Wang: | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2577-1 CVE-2012-4559 CVE-2012-4561 CVE-2012-4562 CVE-2012-6063 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | libssh |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:17868 | |||
| Oval ID: | oval:org.mitre.oval:def:17868 | ||
| Title: | USN-1640-1 -- libssh vulnerabilities | ||
| Description: | linssh could be made to crash or run programs if it received specially crafted network traffic. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-1640-1 CVE-2012-4559 CVE-2012-4560 CVE-2012-4561 CVE-2012-4562 | Version: | 7 |
| Platform(s): | Ubuntu 12.10 Ubuntu 12.04 Ubuntu 11.10 Ubuntu 10.04 | Product(s): | libssh |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-12-10 | Name : Fedora Update for libssh FEDORA-2012-18687 File : nvt/gb_fedora_2012_18687_libssh_fc16.nasl |
| 2012-12-04 | Name : Debian Security Advisory DSA 2577-1 (libssh) File : nvt/deb_2577_1.nasl |
| 2012-12-04 | Name : Mandriva Update for libssh MDVSA-2012:175 (libssh) File : nvt/gb_mandriva_MDVSA_2012_175.nasl |
| 2012-11-29 | Name : Fedora Update for libssh FEDORA-2012-18677 File : nvt/gb_fedora_2012_18677_libssh_fc17.nasl |
| 2012-11-29 | Name : Ubuntu Update for libssh USN-1640-1 File : nvt/gb_ubuntu_USN_1640_1.nasl |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-836.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-840.nasl - Type : ACT_GATHER_INFO |
| 2014-02-23 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201402-26.nasl - Type : ACT_GATHER_INFO |
| 2013-04-20 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-045.nasl - Type : ACT_GATHER_INFO |
| 2013-01-25 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_libssh2-121120.nasl - Type : ACT_GATHER_INFO |
| 2012-12-07 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2012-341-02.nasl - Type : ACT_GATHER_INFO |
| 2012-12-07 | Name : The remote Fedora host is missing a security update. File : fedora_2012-18687.nasl - Type : ACT_GATHER_INFO |
| 2012-12-03 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2577.nasl - Type : ACT_GATHER_INFO |
| 2012-11-30 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2012-175.nasl - Type : ACT_GATHER_INFO |
| 2012-11-29 | Name : The remote Fedora host is missing a security update. File : fedora_2012-18677.nasl - Type : ACT_GATHER_INFO |
| 2012-11-27 | Name : The remote Fedora host is missing a security update. File : fedora_2012-18610.nasl - Type : ACT_GATHER_INFO |
| 2012-11-27 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1640-1.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:31:28 |
|
| 2012-12-19 13:26:44 |
|
| 2012-12-04 00:19:39 |
|
| 2012-12-01 17:19:28 |
|
