Florian Weimer of the Red Hat Product Security Team reported many instances of overflow checks in libssh's buffer.c that were incorrect: if ((buffer->pos + hostlen) > buffer->used) { This should probably be: if (hostlen > buffer->used - buffer->pos) { It seems this could be used to trigger a large memory allocation which is immediately freed, so this is mostly harmless (not exploitable for code execution or denial of service). A similar problem occurs in buffer_add_data(): if (buffer->allocated < (buffer->used + len)) { len should stand on its own. Likewise in buffer_prepend_data(): if (buffer->allocated < (buffer->used - buffer->pos + len)) { And buffer_pass_bytes(), buffer_pass_bytes_end(), buffer_get_mpint(): if(buffer->used < buffer->pos+len) if(buffer->used < buffer->pos + len) if ((buffer->pos + len) > buffer->used) { While it is not certain that any of these are actually be exploitable, the checks are incorrect and need to be fixed.
Another issue was found in src/dh.c: ssh_get_hexa(), as well as src/buffer.c: ssh_buffer_free(), and a few issues in src/string.c: ssh_string_to_char().
Created attachment 645002 [details] CVE-2012-4562-Fix-possible-integer-overflow-in-ssh_g.patch
Created attachment 645003 [details] CVE-2012-4562-Fix-multiple-integer-overflows-in-buff.patch
Created attachment 645004 [details] CVE-2012-4562-Fix-a-possible-infinite-loop-in-buffer.patch
Created attachment 645018 [details] CVE-2012-4562-Fix-possible-string-related-integer-ov.patch
Fixed upstream: http://www.libssh.org/2012/11/20/libssh-0-5-3-security-release/
Created libssh tracking bugs for this issue Affects: fedora-all [bug 878521]
libssh-0.5.3-1.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.
libssh-0.5.3-1.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.
libssh-0.5.3-1.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.