CVE-2013-0176: Null Pointer Dereference
The publickeyfromprivatekey function in libssh before 0.5.4, when no algorithm is matched during negotiations, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a "Client: Diffie-Hellman Key Exchange Init" packet.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0176?
CVE-2013-0176 has a severity rating of medium due to its potential for denial of service.
How do I fix CVE-2013-0176?
To fix CVE-2013-0176, upgrade to libssh version 0.5.4 or newer.
What systems are affected by CVE-2013-0176?
CVE-2013-0176 affects libssh versions prior to 0.5.4, specifically versions 0.4.7, 0.4.8, 0.5.0, 0.5.1, and 0.5.2.
What causes the vulnerability in CVE-2013-0176?
CVE-2013-0176 is caused by a NULL pointer dereference when no algorithm is matched during the key exchange negotiations.
Can CVE-2013-0176 be exploited remotely?
Yes, CVE-2013-0176 can be exploited remotely through specially crafted 'Client: Diffie-Hellman Key Exchange Init' packets.