libssh vulnerability: Critical flaw in Linux and Mac SSH/SFTP services
Who is using libssh?
Libssh is used mostly to allow secure connections between server and clients. It is used for secure file transfers (secure FTP) between different computers in projects like KDE and produces secure connections in projects like Github and X2Go etc. l
How an attacker can gain access to your server?
Instead of request to authenticate in the system, an attacker can send a request that authentication is already successful and gain up to the highest permissions and execute absolutely arbitrary code. In fact, attacker presents the server a SSH2_MSG_USERAUTH_SUCCESS message
in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect
to initiate authentication.
Which devices are affected?
Servers that are using libssh versions 0.6 and above are vulnerable
How to check if you’re vulnerable?
You can easily check whether you are vulnerable using code below:
https://github.com/leapsecurity/libssh-scanner
How to fix up?
To fix this vulnerability you should visit the official site
https://www.libssh.org/2016/02/23/libssh-0-7-3-security-and-bugfix-release/
and update your libssh library.
Reference:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10933
https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/
https://www.libssh.org/security/advisories/CVE-2018-10933.txt
Get the Help You Need
Cybersecurity is our core expertise. Let’s get in touch and you will learn more about how UnderDefense can benefit your organizationÂ
Next Readers
Private Equity Firms Must Enhance Cybersecurity to Protect their Portfolio Companies and Finances
There is no end to Cyber Risk so go into battle with the best... Risk for 400M or WHY we talk about it Recently, one portfolio company of a big Los Angeles PE firm paid $400M in bitcoin as Ransomware to attackers for decrypting their systems and getting back to...
E-Mail Under Attack. Why EDR/AV/VA is Insufficient, and MDR is a Must
Why It’s Important Email is one of the most valuable IT systems where organization share their plans, sensitive documents, chats….and even passwords. UnderDefense, in cooperation with the Computer Emergency Response Team of Ukraine (CERT-UA) participated in a series...
Remote Access Threat
Malicious Actors have a new trend - brute-forcing various remote desktop SaaS services/tools like AnyDesk, GoToMyPC, Zoho Assist, RemotePC, VNC Connect, DameWare Mini Remote Control, etc. to gain unrestricted access to internal corporate networks without any...