CVE-2012-4559: Double Free
Florian Weimer of the Red Hat Product Security Team reported several instances of code in libssh where a heap region is deallocated twice, first in the main path and then on the error path. This could crash the process using libssh, or possible allow for the execution of arbitrary code.
The identified affected variables are:
agent.c:agentsigndata(): request channels.c:channelrequest(): req auth.c:sshuserauthpubkey(): user, service, method, algo, pkstr sftp.c:sftpparseattr3(): longname, name sftp.c:sftpmkdir(): buffer, path keyfiles.c:trypublickeyfromfile(): pubkey
sftp.c:sftpmkdir() has been corrected via the following git commit:
http://git.libssh.org/projects/libssh.git/commit/?h=v0-5&id=4d8420f3282ed07fc99fc5e930c17df27ef1e9b2
Other sources
Multiple double free vulnerabilities in the (1) agentsigndata function in agent.c, (2) channelrequest function in channels.c, (3) sshuserauthpubkey function in auth.c, (4) sftpparseattr3 function in sftp.c, and (5) trypublickeyfromfile function in keyfiles.c in libssh before 0.5.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4559?
CVE-2012-4559 has been classified with a critical severity due to the potential for arbitrary code execution or process crashes.
How do I fix CVE-2012-4559?
To fix CVE-2012-4559, upgrade libssh to version 0.5.4 or higher, which contains the necessary security patches.
Which versions of libssh are affected by CVE-2012-4559?
Versions of libssh prior to 0.5.4, including 0.5.3 and earlier, are affected by CVE-2012-4559.
What are the potential risks of CVE-2012-4559?
The potential risks of CVE-2012-4559 include application crashes or the execution of arbitrary code, compromising system integrity.
Is my system vulnerable to CVE-2012-4559?
If you are using libssh version 0.5.3 or earlier, your system is vulnerable to CVE-2012-4559.