Last week, a very serious vulnerability was found in the LibSSH library, which, if exploited properly, can allow access to locked systems without users entering valid login credentials. Since then, many scripts and automated tools have been released. Using them, hackers can gain access to your computer systems with just a few clicks! The vulnerability has been codenamed CVE-2018-10933, and it can be exploited very easily.
While the vulnerability has been fixed with versions 0.7.6 and 0.8.4, researchers have released scanners and scripts that check for and exploit vulnerable versions. So if you are using LibSSH, you should update it immediately!
Many manufacturers and organizations have published about this specific vulnerability.
CISCO announced that some of its products use the LibSSH library and that it is currently conducting research to identify them. Debian, SUSE, Ubuntu and Arch Linux have already released updates that users can download and install. Dell announced that the NSeries uses the LibSSH2 library, which does not show any vulnerabilities.
Since the vulnerability was made public and given the name CVE-2018-10933, automated programs that exploit it have begun to circulate. Using them, anyone – and indeed anyone – can scan and hack into vulnerable systems. For example, Leap Security has created a tool that can check whether a device is vulnerable or not.
With the abundance of tools available, anyone using devices that have not been updated with security updates should install them immediately.
