CVE-2015-3146

What it actually does

Remote attackers can trigger a NULL pointer dereference crash in libssh SSH_MSG_NEWKEYS and SSH_MSG_KEXDH_REPLY packet handlers by sending crafted packets that bypass state validation in package_cb.c.

Why it matters to the business

Attackers can remotely crash SSH servers causing service outages and operational disruption; the flaw affects widely used Linux distributions and libssh deployments with no active exploitation or ransomware campaigns observed.

How an attack unfolds

An attacker connects to a vulnerable libssh server and sends specially crafted SSH_MSG_NEWKEYS or SSH_MSG_KEXDH_REPLY packets that reach the handlers without the expected prior state, resulting in a NULL dereference and immediate process termination.

How to fix it

Upgrade libssh to version 0.6.5 or later on all affected systems; apply vendor patches for Ubuntu, Debian, and Fedora distributions as soon as available.

How to confirm the fix worked

Verify installed libssh version is 0.6.5 or newer; recompile or reinstall from updated packages and confirm absence of the vulnerable package_cb.c handlers via source inspection or binary analysis.

Typical attack path

1. Establish TCP connection to SSH port on target
2. Send malformed SSH_MSG_NEWKEYS or SSH_MSG_KEXDH_REPLY packets before completing key exchange
3. Trigger NULL pointer dereference causing daemon crash

How to detect it

Review SSH daemon logs and system crash reports for abrupt terminations during key exchange phases; look for unexpected restarts of sshd processes without corresponding authentication events.

What your security team should do

• Prioritize patching libssh on all internet-facing SSH servers
• Monitor for unexpected SSH daemon restarts in logs
• Restrict SSH access via network controls until patches are applied