CVE-2012-4559
published 2012-11-30CVE-2012-4559: Multiple double free vulnerabilities in the (1) agent_sign_data function in agent.c, (2) channel_request function in channels.c, (3) ssh_userauth_pubkey…
PriorityP434medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
5.18%
91.5th percentile
Multiple double free vulnerabilities in the (1) agent_sign_data function in agent.c, (2) channel_request function in channels.c, (3) ssh_userauth_pubkey function in auth.c, (4) sftp_parse_attr_3 function in sftp.c, and (5) try_publickey_from_file function in keyfiles.c in libssh before 0.5.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libssh | < libssh 0.5.3-1 (bookworm) | libssh 0.5.3-1 (bookworm) |
| libssh | libssh | <= 0.5.2 | — |
| libssh | libssh | — | — |
| libssh | libssh | — | — |
| libssh | libssh | — | — |
| libssh | libssh | — | — |
| libssh | libssh | >= 0 < 0.5.3-1 | 0.5.3-1 |
| libssh | libssh | >= 0 < 0.5.3-1 | 0.5.3-1 |
| libssh | libssh | >= 0 < 0.5.3-1 | 0.5.3-1 |
| libssh | libssh | >= 0 < 0.5.3-1 | 0.5.3-1 |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv6.8MEDIUM
vendor_debian6.8MEDIUM
vendor_ubuntu6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libssh vulnerabilities
vendor_ubuntu·2012-11-26·CVSS 6.8
CVE-2012-4559 [MEDIUM] libssh vulnerabilities
Title: libssh vulnerabilities
Summary: linssh could be made to crash or run programs if it received specially
crafted network traffic.
Xi Wang and Florian Weimer discovered that libssh incorrectly handled
memory. A remote attacker could use this to cause libssh to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2012-4559, CVE-2012-4560, CVE-2012-4561, CVE-2012-4562)
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2012-6063: libssh - Double free vulnerability in the sftp_mkdir function in sftp.c in libssh before ...
vendor_debian·2012·CVSS 6.8
CVE-2012-6063 [MEDIUM] CVE-2012-6063: libssh - Double free vulnerability in the sftp_mkdir function in sftp.c in libssh before ...
Double free vulnerability in the sftp_mkdir function in sftp.c in libssh before 0.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors, a different vector than CVE-2012-4559.
Scope: local
bookworm: resolved (fixed in 0.5.3-1)
bullseye: resolved (fixed in 0.5.3-1)
forky: resolved (fixed in 0.5.3-1)
sid: resolved (fixed in 0.5.3-1)
trixie: resolved (fixed in 0.5.3-1)
Debian
CVE-2012-4559: libssh - Multiple double free vulnerabilities in the (1) agent_sign_data function in agen...
vendor_debian·2012·CVSS 6.8
CVE-2012-4559 [MEDIUM] CVE-2012-4559: libssh - Multiple double free vulnerabilities in the (1) agent_sign_data function in agen...
Multiple double free vulnerabilities in the (1) agent_sign_data function in agent.c, (2) channel_request function in channels.c, (3) ssh_userauth_pubkey function in auth.c, (4) sftp_parse_attr_3 function in sftp.c, and (5) try_publickey_from_file function in keyfiles.c in libssh before 0.5.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
Scope: local
bookworm: resolved (fixed in 0.5.3-1)
bullseye: resolved (fixed in 0.5.3-1)
forky: resolved (fixed in 0.5.3-1)
sid: resolved (fixed in 0.5.3-1)
trixie: resolved (fixed in 0.5.3-1)
GHSA
GHSA-fgm4-g835-pxpp: Double free vulnerability in the sftp_mkdir function in sftp
ghsa_unreviewed·2022-05-17·CVSS 6.8
CVE-2012-6063 [MEDIUM] GHSA-fgm4-g835-pxpp: Double free vulnerability in the sftp_mkdir function in sftp
Double free vulnerability in the sftp_mkdir function in sftp.c in libssh before 0.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors, a different vector than CVE-2012-4559.
GHSA
GHSA-px93-6r58-rr4j: Multiple double free vulnerabilities in the (1) agent_sign_data function in agent
ghsa_unreviewed·2022-05-17
CVE-2012-4559 [MEDIUM] GHSA-px93-6r58-rr4j: Multiple double free vulnerabilities in the (1) agent_sign_data function in agent
Multiple double free vulnerabilities in the (1) agent_sign_data function in agent.c, (2) channel_request function in channels.c, (3) ssh_userauth_pubkey function in auth.c, (4) sftp_parse_attr_3 function in sftp.c, and (5) try_publickey_from_file function in keyfiles.c in libssh before 0.5.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
OSV
CVE-2012-4559: Multiple double free vulnerabilities in the (1) agent_sign_data function in agent
osv·2012-11-30·CVSS 6.8
CVE-2012-4559 [MEDIUM] CVE-2012-4559: Multiple double free vulnerabilities in the (1) agent_sign_data function in agent
Multiple double free vulnerabilities in the (1) agent_sign_data function in agent.c, (2) channel_request function in channels.c, (3) ssh_userauth_pubkey function in auth.c, (4) sftp_parse_attr_3 function in sftp.c, and (5) try_publickey_from_file function in keyfiles.c in libssh before 0.5.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
OSV
CVE-2012-6063: Double free vulnerability in the sftp_mkdir function in sftp
osv·2012-11-30·CVSS 6.8
CVE-2012-6063 [MEDIUM] CVE-2012-6063: Double free vulnerability in the sftp_mkdir function in sftp
Double free vulnerability in the sftp_mkdir function in sftp.c in libssh before 0.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors, a different vector than CVE-2012-4559.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-4559 CVE-2012-4560 CVE-2012-4561 CVE-2012-4562 libssh various flaws [fedora-all]
bugzilla·2012-11-20·CVSS 6.8
CVE-2012-4559 [MEDIUM] CVE-2012-4559 CVE-2012-4560 CVE-2012-4561 CVE-2012-4562 libssh various flaws [fedora-all]
CVE-2012-4559 CVE-2012-4560 CVE-2012-4561 CVE-2012-4562 libssh various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note: th
Bugzilla
CVE-2012-4559 CVE-2012-6063 libssh: multiple double free() flaws
bugzilla·2012-10-30·CVSS 6.8
CVE-2012-4559 [MEDIUM] CVE-2012-4559 CVE-2012-6063 libssh: multiple double free() flaws
CVE-2012-4559 CVE-2012-6063 libssh: multiple double free() flaws
Florian Weimer of the Red Hat Product Security Team reported several instances of code in libssh where a heap region is deallocated twice, first in the main path and then on the error path. This could crash the process using libssh, or possible allow for the execution of arbitrary code.
The identified affected variables are:
agent.c:agent_sign_data(): request
channels.c:channel_request(): req
auth.c:ssh_userauth_pubkey(): user, service, method, algo, pkstr
sftp.c:sftp_parse_attr_3(): longname, name
sftp.c:sftp_mkdir(): buffer, path
keyfiles.c:try_publickey_from_file(): pubkey
sftp.c:sftp_mkdir() has been corrected via the following git commit:
http://git.libssh.org/projects/libssh.git/commit/?h=v0-5&id=4d8420f3282ed07fc9
http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093313.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-November/093474.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-12/msg00002.htmlhttp://lists.opensuse.org/opensuse-updates/2012-12/msg00016.htmlhttp://lists.opensuse.org/opensuse-updates/2013-01/msg00021.htmlhttp://www.debian.org/security/2012/dsa-2577http://www.libssh.org/2012/11/20/libssh-0-5-3-security-release/http://www.mandriva.com/security/advisories?name=MDVSA-2012:175http://www.openwall.com/lists/oss-security/2012/11/20/3http://www.securityfocus.com/bid/56604http://www.ubuntu.com/usn/USN-1640-1https://bugzilla.redhat.com/show_bug.cgi?id=871612https://exchange.xforce.ibmcloud.com/vulnerabilities/80218http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093313.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-November/093474.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-12/msg00002.htmlhttp://lists.opensuse.org/opensuse-updates/2012-12/msg00016.htmlhttp://lists.opensuse.org/opensuse-updates/2013-01/msg00021.htmlhttp://www.debian.org/security/2012/dsa-2577http://www.libssh.org/2012/11/20/libssh-0-5-3-security-release/http://www.mandriva.com/security/advisories?name=MDVSA-2012:175http://www.openwall.com/lists/oss-security/2012/11/20/3http://www.securityfocus.com/bid/56604http://www.ubuntu.com/usn/USN-1640-1https://bugzilla.redhat.com/show_bug.cgi?id=871612https://exchange.xforce.ibmcloud.com/vulnerabilities/80218
2012-11-30
Published