CVE-2012-4561
published 2012-11-30CVE-2012-4561: The (1) publickey_make_dss, (2) publickey_make_rsa, (3) signature_from_string, (4) ssh_do_sign, and (5) ssh_sign_session_id functions in keys.c in libssh…
PriorityP421medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
4.75%
90.9th percentile
The (1) publickey_make_dss, (2) publickey_make_rsa, (3) signature_from_string, (4) ssh_do_sign, and (5) ssh_sign_session_id functions in keys.c in libssh before 0.5.3 free "an invalid pointer on an error path," which might allow remote attackers to cause a denial of service (crash) via unspecified vectors.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libssh | < libssh 0.5.3-1 (bookworm) | libssh 0.5.3-1 (bookworm) |
| libssh | libssh | <= 0.5.2 | — |
| libssh | libssh | — | — |
| libssh | libssh | — | — |
| libssh | libssh | — | — |
| libssh | libssh | — | — |
| libssh | libssh | >= 0 < 0.5.3-1 | 0.5.3-1 |
| libssh | libssh | >= 0 < 0.5.3-1 | 0.5.3-1 |
| libssh | libssh | >= 0 < 0.5.3-1 | 0.5.3-1 |
| libssh | libssh | >= 0 < 0.5.3-1 | 0.5.3-1 |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.0MEDIUM
vendor_ubuntu6.8MEDIUM
vendor_debian5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-m2v7-9rhw-324g: The (1) publickey_make_dss, (2) publickey_make_rsa, (3) signature_from_string, (4) ssh_do_sign, and (5) ssh_sign_session_id functions in keys
ghsa_unreviewed·2022-05-17
CVE-2012-4561 [MEDIUM] GHSA-m2v7-9rhw-324g: The (1) publickey_make_dss, (2) publickey_make_rsa, (3) signature_from_string, (4) ssh_do_sign, and (5) ssh_sign_session_id functions in keys
The (1) publickey_make_dss, (2) publickey_make_rsa, (3) signature_from_string, (4) ssh_do_sign, and (5) ssh_sign_session_id functions in keys.c in libssh before 0.5.3 free "an invalid pointer on an error path," which might allow remote attackers to cause a denial of service (crash) via unspecified vectors.
OSV
CVE-2012-4561: The (1) publickey_make_dss, (2) publickey_make_rsa, (3) signature_from_string, (4) ssh_do_sign, and (5) ssh_sign_session_id functions in keys
osv·2012-11-30·CVSS 5.0
CVE-2012-4561 [MEDIUM] CVE-2012-4561: The (1) publickey_make_dss, (2) publickey_make_rsa, (3) signature_from_string, (4) ssh_do_sign, and (5) ssh_sign_session_id functions in keys
The (1) publickey_make_dss, (2) publickey_make_rsa, (3) signature_from_string, (4) ssh_do_sign, and (5) ssh_sign_session_id functions in keys.c in libssh before 0.5.3 free "an invalid pointer on an error path," which might allow remote attackers to cause a denial of service (crash) via unspecified vectors.
Ubuntu
libssh vulnerabilities
vendor_ubuntu·2012-11-26·CVSS 6.8
CVE-2012-4559 [MEDIUM] libssh vulnerabilities
Title: libssh vulnerabilities
Summary: linssh could be made to crash or run programs if it received specially
crafted network traffic.
Xi Wang and Florian Weimer discovered that libssh incorrectly handled
memory. A remote attacker could use this to cause libssh to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2012-4559, CVE-2012-4560, CVE-2012-4561, CVE-2012-4562)
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2012-4561: libssh - The (1) publickey_make_dss, (2) publickey_make_rsa, (3) signature_from_string, (...
vendor_debian·2012·CVSS 5.0
CVE-2012-4561 [MEDIUM] CVE-2012-4561: libssh - The (1) publickey_make_dss, (2) publickey_make_rsa, (3) signature_from_string, (...
The (1) publickey_make_dss, (2) publickey_make_rsa, (3) signature_from_string, (4) ssh_do_sign, and (5) ssh_sign_session_id functions in keys.c in libssh before 0.5.3 free "an invalid pointer on an error path," which might allow remote attackers to cause a denial of service (crash) via unspecified vectors.
Scope: local
bookworm: resolved (fixed in 0.5.3-1)
bullseye: resolved (fixed in 0.5.3-1)
forky: resolved (fixed in 0.5.3-1)
sid: resolved (fixed in 0.5.3-1)
trixie: resolved (fixed in 0.5.3-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-4559 CVE-2012-4560 CVE-2012-4561 CVE-2012-4562 libssh various flaws [fedora-all]
bugzilla·2012-11-20·CVSS 6.8
CVE-2012-4559 [MEDIUM] CVE-2012-4559 CVE-2012-4560 CVE-2012-4561 CVE-2012-4562 libssh various flaws [fedora-all]
CVE-2012-4559 CVE-2012-4560 CVE-2012-4561 CVE-2012-4562 libssh various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note: th
Bugzilla
CVE-2012-4561 libssh: multiple invalid free() flaws
bugzilla·2012-10-30·CVSS 5.0
CVE-2012-4561 [MEDIUM] CVE-2012-4561 libssh: multiple invalid free() flaws
CVE-2012-4561 libssh: multiple invalid free() flaws
Florian Weimer of the Red Hat Product Security Team reported the existence of several unitialized heap allocations in the following functions:
keys.c:publickey_make_dss() (key)
keys.c:publickey_make_rsa() (key)
keys.c:signature_from_string() (sign)
keys.c:ssh_do_sign() (sign)
keys.c:ssh_sign_session_id() (sign)
This could lead to freeing an invalid pointer on an error path, which could lead to a crash in the process using libssh.
Discussion:
Created attachment 644662
CVE-2012-4561-Fix-error-handling-of-try_publickey_fr.patch
---
Created attachment 644663
CVE-2012-4561-Fix-possible-free-s-on-invalid-pointer.patch
---
Created attachment 644998
CVE-2012-4561-Fix-error-handling-of-try_publickey_fr.patch
---
Created attachment 64499
http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093313.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-November/093474.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-12/msg00002.htmlhttp://lists.opensuse.org/opensuse-updates/2012-12/msg00016.htmlhttp://lists.opensuse.org/opensuse-updates/2013-01/msg00021.htmlhttp://www.debian.org/security/2012/dsa-2577http://www.libssh.org/2012/11/20/libssh-0-5-3-security-release/http://www.mandriva.com/security/advisories?name=MDVSA-2012:175http://www.openwall.com/lists/oss-security/2012/11/20/3http://www.securityfocus.com/bid/56604http://www.ubuntu.com/usn/USN-1640-1https://bugzilla.redhat.com/show_bug.cgi?id=871617https://exchange.xforce.ibmcloud.com/vulnerabilities/80220http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093313.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-November/093474.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-12/msg00002.htmlhttp://lists.opensuse.org/opensuse-updates/2012-12/msg00016.htmlhttp://lists.opensuse.org/opensuse-updates/2013-01/msg00021.htmlhttp://www.debian.org/security/2012/dsa-2577http://www.libssh.org/2012/11/20/libssh-0-5-3-security-release/http://www.mandriva.com/security/advisories?name=MDVSA-2012:175http://www.openwall.com/lists/oss-security/2012/11/20/3http://www.securityfocus.com/bid/56604http://www.ubuntu.com/usn/USN-1640-1https://bugzilla.redhat.com/show_bug.cgi?id=871617https://exchange.xforce.ibmcloud.com/vulnerabilities/80220
2012-11-30
Published