Executive Summary

This vulnerability exists in libssh2 versions up to 1.11.1 in the sftp_symlink() function. It is an out-of-bounds heap read caused by improper validation of the link_len value in SSH_FXP_NAME responses during SFTP READLINK and REALPATH operations. A malicious SSH server or man-in-the-middle attacker can send a crafted SSH_FXP_NAME response with a link_len larger than the actual packet data, which triggers a heap buffer over-read. This can lead to disclosure of heap memory contents or cause the application to crash.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by allowing an attacker to disclose sensitive heap memory contents, potentially exposing confidential information. Additionally, it can cause the affected application to crash, leading to denial of service. The attacker can exploit this by acting as a malicious SSH server or performing a man-in-the-middle attack.

Useful 0 Not Useful 0