The remote ssh server is vulnerable to an authentication bypass. An attacker can bypass authentication by presenting SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST method that normally would initiate authentication.

Note: This vulnerability was disclosed in a libssh advisory but has also been observed as applicable to other applications and software packages.

This update for libssh fixes the following security issue :

  - CVE-2018-10933: Fixed a server mode authentication     bypass (boo#1108020).

This update was imported from the SUSE:SLE-12:Update update project.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0087 advisory.

    This advisory aggregates security fixes for the libssh SRPM in CIQ LTS 8.6. It addresses 14 CVEs:
    CVE-2014-0017, CVE-2023-48795, CVE-2016-0739, CVE-2018-10933, CVE-2023-51385, and 9 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Peter Winter-Smith of NCC Group discovered that libssh, a tiny C SSH library, contains an authentication bypass vulnerability in the server code. An attacker can take advantage of this flaw to successfully authenticate without any credentials by presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3795-1 advisory.

    Peter Winter-Smith discovered that libssh incorrectly handled authentication when being used as a server.
    A remote attacker could use this issue to bypass authentication without any credentials.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its banner version, the remote libssh based server is vulnerable to an authentication bypass.  An attacker can bypass authentication by presenting a SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST method that normally would initiate authentication.

Note that Nessus did not actually test for the flaw but instead has relied on the version in the libssh banner so this may be a false positive.

New libssh packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix a security issue.

This update for libssh fixes the following issues :

  - CVE-2018-10933: Fixed a server mode authentication     bypass (bsc#1108020).

This update was imported from the SUSE:SLE-15:Update update project.

Update to version 0.7.6 to address CVE-2018-10933

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.02, has libssh packages installed that are affected by multiple vulnerabilities:

  - The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state     of the OpenSSL pseudo-random number generator (PRNG), which causes the state to be shared between children     processes and allows local users to obtain sensitive information by leveraging a pid collision.
    (CVE-2014-0017)

  - A vulnerability was found in libssh's server-side state machine. A malicious client could create channels     without first performing authentication, resulting in unauthorized access. (CVE-2018-10933)

  - A flaw was found with the libssh API function ssh_scp_new(). A user able to connect to a server using SCP     could execute arbitrary command using a user-provided path, leading to a compromise of the remote target.
    (CVE-2019-14889)

  - A flaw was found in libssh. A NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.
    (CVE-2020-16135)

  - A flaw was found in the way libssh handled AES-CTR (or DES ciphers if enabled) ciphers. The server or     client could crash when the connection hasn't been fully initialized and the system tries to cleanup the     ciphers when closing the connection. The biggest threat from this vulnerability is system availability.
    (CVE-2020-1730)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the libssh package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A vulnerability was found in libssh's server-side state     machine before versions 0.7.6 and 0.8.4. A malicious     client could create channels without first performing     authentication, resulting in unauthorized     access.(CVE-2018-10933)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
118154	SSH Protocol Authentication Bypass (Remote Exploit Check)	Nessus	Misc.	2018/10/17	2026/1/12	critical
118250	openSUSE Security Update : libssh (openSUSE-2018-1207)	Nessus	SuSE Local Security Checks	2018/10/22	2024/7/30	critical
359410	Rocky Linux 8.6 [CIQ] Security Update: libssh / libssh-config / libssh-debuginfo / libssh-debugsource / etc Multiple Vulnerabilities (ciqsa-2026_0087)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/11	critical
118180	Debian DSA-4322-1 : libssh - security update	Nessus	Debian Local Security Checks	2018/10/18	2024/7/30	critical
118200	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : libssh vulnerability (USN-3795-1)	Nessus	Ubuntu Local Security Checks	2018/10/18	2024/8/27	critical
118155	libssh 0.6.x / 0.7.x < 0.7.6 / 0.8.x < 0.8.4 Authentication Bypass (Remote Version Check)	Nessus	Misc.	2018/10/17	2020/5/15	critical
118168	Slackware 14.0 / 14.1 / 14.2 / current : libssh (SSA:2018-289-01)	Nessus	Slackware Local Security Checks	2018/10/17	2024/7/30	critical
118191	openSUSE Security Update : libssh (openSUSE-2018-1180)	Nessus	SuSE Local Security Checks	2018/10/18	2024/7/30	critical
118243	Fedora 27 : libssh (2018-bca1c1ab49)	Nessus	Fedora Local Security Checks	2018/10/22	2024/7/30	critical
206832	NewStart CGSL MAIN 6.02 : libssh Multiple Vulnerabilities (NS-SA-2024-0052)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2026/2/24	critical
129260	EulerOS 2.0 SP3 : libssh (EulerOS-SA-2019-2067)	Nessus	Huawei Local Security Checks	2019/9/24	2024/4/23	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical