libssh up to 0.8.7/0.9.2 scp Client ssh_scp_new Parameter command injection

Summaryinfo

A vulnerability identified as critical has been detected in libssh up to 0.8.7/0.9.2. This impacts the function ssh_scp_new of the component scp Client. Performing a manipulation as part of Parameter results in command injection. This vulnerability is known as CVE-2019-14889. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in libssh up to 0.8.7/0.9.2. This affects the function ssh_scp_new of the component scp Client. The manipulation as part of a Parameter leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target.

The weakness was published 12/10/2019 (Website). The advisory is shared at usn.ubuntu.com. This vulnerability is uniquely identified as CVE-2019-14889 since 08/10/2019. The exploitability is told to be difficult. It is possible to initiate the attack remotely. A authentication is required for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1202 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 236741 (Alibaba Cloud Linux 3 : 0067: libssh (ALINUX3-SA-2022:0067)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.8.8 or 0.9.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (236741). Similar entry is available at VDB-153566. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• libssh

Version

• 0.8.0
• 0.8.1
• 0.8.2
• 0.8.3
• 0.8.4
• 0.8.5
• 0.8.6
• 0.8.7
• 0.9.0
• 0.9.1
• 0.9.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion