Denial of Service Vulnerability in Nmap: CVE-2017-18594
Summary
ALPINE-CVE-2017-18594: nse_libssh2.cc in Nmap 7.70 is subject to a denial of service condition due to a double free when an SSH connection fails, as demonstrated by a leading \n character to ssh-brute.nse or ssh-auth-methods.nse. Affects nmap versions < 7.70-r4. Fixed in 7.70-r4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nmap is a widely used open-source network scanning tool that allows users to discover hosts and services on a computer network. It is known for its versatility, supporting a variety of scanning techniques and offering extensive features for network exploration and security auditing. However, Nmap is susceptible to a specific vulnerability that can lead to a denial of service condition.
Vulnerability Detail
The vulnerability, identified as CVE-2017-18594, originates from a flaw in the nse_libssh2.cc file within Nmap version 7.70. It is caused by a double free error that occurs when an SSH connection fails, particularly when a leading newline character is present in scripts like ssh-brute.nse or ssh-auth-methods.nse. This flaw can lead to unexpected behavior, potentially crashing the application and disrupting network scanning operations.
How To Fix
Minimum fixed version
7.70-r4
This is the first release that contains the fix.
sudo apk add --upgrade nmapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected scripts (ssh-brute.nse and ssh-auth-methods.nse) until the package is updated to a secure version. This can help mitigate the risk of triggering the vulnerability while a permanent fix is being implemented.
Conclusion
CVE-2017-18594 represents a significant vulnerability in Nmap that can lead to denial of service conditions. Users are advised to update their Nmap installations to the latest patched versions to mitigate the risk. Additionally, temporary workarounds can be employed until the updates are applied.
See every vulnerability recorded for nmap →
FAQ
CVE-2017-18594 is a vulnerability in Nmap that can lead to a denial of service due to a double free error when an SSH connection fails.
This vulnerability can cause Nmap to crash, disrupting network scanning operations and potentially affecting network security assessments.
Nmap versions prior to 7.70-r4 for Alpine v3.10 and prior to 7.80-r0 for Alpine v3.11 and later are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2017-18594 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for nmap.
