Service fingerprint update / fix for libssh (patch)

[Brandon Enright via dev]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi folks,

There is a fun authentication bypass (CVE-2018-10933) for libssh out
today:
https://www.libssh.org/security/advisories/CVE-2018-10933.txt
https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/

I did some scanning and noticed the fingerprint in the
nmap-service-probes file doesn't match any of the services I could find.

It seems some versions of libssh use an underscore as the separator
character for the version like so:

SF:L,16,"SSH-2\.0-libssh_0\.7\.5\r\n");

Attached is a patch that allows both an underscore and hyphen so that
the fingerprint matches more versions.

Regards,

Brandon

[David Fifield]

Post by Brandon Enright via dev
It seems some versions of libssh use an underscore as the separator
SF:L,16,"SSH-2\.0-libssh_0\.7\.5\r\n");
Attached is a patch that allows both an underscore and hyphen so that
the fingerprint matches more versions.

Looks right to me.
https://git.libssh.org/projects/libssh.git/tree/include/libssh/priv.h?id=60037f327540f9ff2255cb6cc6bba78ea1f066b9#n159
#ifndef CLIENT_BANNER_SSH2
#define CLIENT_BANNER_SSH2 "SSH-2.0-libssh_" SSH_STRINGIFY(LIBSSH_VERSION)
#endif /* CLIENT_BANNER_SSH2 */
It's called "CLIENT"_BANNER_SSH2 but it's also sent by the server code.

It switched from hyphen to underscore in 2016 (released 2017 in version 0.7.4).
https://git.libssh.org/projects/libssh.git/commit/?id=b5ce15eefa5b3e949d71a640cf03a0c0f42805ae
#ifndef CLIENTBANNER1
-#define CLIENTBANNER1 "SSH-1.5-libssh-" SSH_STRINGIFY(LIBSSH_VERSION)
+#define CLIENTBANNER1 "SSH-1.5-libssh_" SSH_STRINGIFY(LIBSSH_VERSION)
#endif
#ifndef CLIENTBANNER2
-#define CLIENTBANNER2 "SSH-2.0-libssh-" SSH_STRINGIFY(LIBSSH_VERSION)
+#define CLIENTBANNER2 "SSH-2.0-libssh_" SSH_STRINGIFY(LIBSSH_VERSION)
#endif

[Fyodor]

Post by Brandon Enright via dev
Attached is a patch that allows both an underscore and hyphen so that
the fingerprint matches more versions.

Thanks Brandon, and also David for the additional research. I've applied
the patch.

Cheers,
Fyodor