Re: [SECURITY ADVISORIES] libssh2

[Riccardo Schirone <rschiron () redhat com>]

Hello,

On 03/18, Daniel Stenberg wrote:
> Hello!
>
> CVE-2019-3863
>  Integer overflow in user authenicate keyboard interactive allows
>  out-of-bounds writes
>  URL: https://www.libssh2.org/CVE-2019-3863.html
>  Patch: https://libssh2.org/1.8.0-CVE/CVE-2019-3863.txt

From the security advisory:
> A server could send a multiple keyboard interactive response messages whose
> total length are greater than unsigned char max characters. This value is
> used as an index to copy memory causing in an out of bounds memory write
> error.

Is this really a security issue? It seems to me the server cannot change what
the interactive keyboard message responses contain. They are, after all,
"interactive keyboard messages", thus coming from the user sitting in front of
the client system.

I can see 3 different "response_callback" functions being used to construct
the responses and in one of them it is probably possible to trigger the
overflow, however it would be caused by the user himself. If we assume the
interactive user should not be able to execute code, I'd say the flaw does not
have a remote attack vector but only local.

Did I miss anything?

Thanks,
-- 
Riccardo Schirone
Red Hat -- Product Security
Email: rschiron () redhat com
PGP-Key ID: CF96E110

Attachment: signature.asc
Description: