CVE-2012-4562: Buffer Overflow
Florian Weimer of the Red Hat Product Security Team reported many instances of overflow checks in libssh's buffer.c that were incorrect:
if ((buffer->pos + hostlen) > buffer->used) {
This should probably be:
if (hostlen > buffer->used - buffer->pos) {
It seems this could be used to trigger a large memory allocation which is immediately freed, so this is mostly harmless (not exploitable for code execution or denial of service).
A similar problem occurs in bufferadddata():
if (buffer->allocated < (buffer->used + len)) {
len should stand on its own.
Likewise in bufferprependdata():
if (buffer->allocated < (buffer->used - buffer->pos + len)) {
And bufferpassbytes(), bufferpassbytesend(), buffergetmpint():
if(buffer->used < buffer->pos+len)
if(buffer->used < buffer->pos + len)
if ((buffer->pos + len) > buffer->used) {
While it is not certain that any of these are actually be exploitable, the checks are incorrect and need to be fixed.
Other sources
Multiple integer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (infinite loop or crash) and possibly execute arbitrary code via unspecified vectors, which triggers a buffer overflow, infinite loop, or possibly some other unspecified vulnerabilities.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4562?
CVE-2012-4562 has been classified as a moderate severity vulnerability affecting libssh.
How do I fix CVE-2012-4562?
To mitigate CVE-2012-4562, update libssh to version 0.5.3 or later.
Which versions of libssh are affected by CVE-2012-4562?
CVE-2012-4562 affects libssh versions 0.4.7, 0.4.8, 0.5.0, 0.5.1, and 0.5.2.
What components are impacted by CVE-2012-4562?
CVE-2012-4562 impacts the libssh library as reported by Florian Weimer.
Is CVE-2012-4562 a buffer overflow vulnerability?
Yes, CVE-2012-4562 is related to incorrect buffer overflow checks in libssh's buffer.c.