Quantum Secular Labs / Blog / Advisories

CVE-2018-10933: Libssh: Improper Authentication

CVE-2018-10933 is rated critical with a CVSS v3.0 base score of 9.1 and affects Libssh, along with 8 other products in NVD’s configuration data. Per its scoring, it can be exploited over the network, without authentication, without any user interaction.

Vulnerability description

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.

Severity breakdown

CVSS v3.0 9.1: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
Attack complexity: Low. No special conditions; the attack can be repeated reliably.
Privileges required: None. No account or prior access is needed.
User interaction: None. No action from any user is needed.
Scope: Unchanged. Impact stays within the vulnerable component.
Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
Availability impact: None. No effect on availability.

Underlying weakness

CWE-287: Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected products

Libssh: from 0.6.0 before 0.7.6; from 0.8.0 before 0.8.4
Canonical Ubuntu Linux: 14.04; 16.04; 18.04; 18.10
Debian Linux: 8.0; 9.0
Red Hat Enterprise Linux: 7.0
Netapp Oncommand Unified Manager: from 7.3; from 9.4
Netapp Oncommand Workflow Automation: all versions listed by NVD
Netapp Snapcenter: all versions listed by NVD
Netapp Storage Automation Store: all versions listed by NVD
Oracle Mysql Workbench: up to and including 8.0.13