[security-announce] libssh: CVE-2016-0739: Security Update

Sona Sarmadi sona.sarmadi at enea.com
Wed Mar 9 07:23:40 CET 2016

Enea Linux Security Advisory

Product/package: libssh 0.6.3/ Enea Linux 5.0
Severity: Medium
CVE Name: CVE-2016-0739
Layer: meta

This security update fixes bits/bytes confusion resulting in truncated
Difffie-Hellman secret length.

libssh versions 0.1 and above have a bits/bytes confusion bug and
generate the an anormaly short ephemeral secret for the
diffie-hellman-group1 and diffie-hellman-group14 key exchange methods.
The resulting secret is 128 bits long, instead of the recommended sizes
of 1024 and 2048 bits respectively. There are practical algorithms (Baby
steps/Giant steps, Pollard's rho) that can solve this problem in O(2^63)

Both client and server are are vulnerable, pre-authentication.
This vulnerability could be exploited by an eavesdropper with enough
resources to decrypt or intercept SSH sessions.

The bug was found during an internal code review by Aris Adamantiadis of
the libssh team.


Upstream patch:

Correction for Enea Linux 5.0:

How to get the latest patches
- If you have already cloned needed repositories, update it to get new
security patches.

cd Enea-Linux-5.0/poky
git pull

- If you have not yet cloned needed repositories, do it as described
below. (All patches are fetched implicitly when cloning the repos).

mkdir Enea-Linux-5.0
git -C Enea-Linux-5.0 clone -b dizzy git://git.enea.com/linux/poky.git
git -C $POKY clone -b dizzy git://git.enea.com/linux/meta-enea.git
git -C $POKY clone -b dizzy git://git.enea.com/linux/meta-fsl-ppc.git
git -C $POKY clone -b dizzy git://git.enea.com/linux/meta-
git -C $POKY clone -b dizzy git://git.enea.com/linux/meta-linaro.git
git -C $POKY clone -b dizzy git://git.enea.com/linux/meta-
git -C $POKY clone -b dizzy
git -C $POKY/meta-enea clone -b dizzy

If you have any questions regarding the security patches and security
updates please contact security at enea.com.

Enea Security Team
Sona Sarmadi
Mobile: +46 70 971 4475

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: OpenPGP digital signature
URL: <http://mail.lists.enea.com/pipermail/security-announce/attachments/20160309/b2360581/attachment-0002.sig>

More information about the security-announce mailing list