Zhangph

wolfSSH fails to validate that the ECDSA curve identifier in a KEXDH REPLY host key blob matches the algorithm negotiated during key exchange. In the `ParseECCPubKey()` function, the blob's algorithm string is used to derive the curve via `NameToId`/`wcPrimeForId` without verifying it against the negotiated `ssh->handshake->pubKeyId`. Additionally, the RFC 5656 curve identifier string is discarded via `GetSkip()` instead of being compared. A man-in-the-middle attacker can substitute a host key blob with a different ECDSA curve, leading the client to import the key on the wrong curve. Since the attacker controls the private key for the substituted curve, signature verification succeeds. This requires an active man-in-the-middle position and a lax public key check callback, such as Trust On First Use (TOFU), algorithm-name-only checks, or fingerprint matches against the parsed key.

When built with the `--enable-fwd` flag, the `DoChannelOpen()` function in `src/internal.c` only applies the forwarding policy callback to `direct-tcpip` channel opens. Consequently, `forwarded-tcpip` opens are permitted without authorization checks and are not limited in number, which allows a malicious SSH peer to force an endpoint to allocate unbounded per-channel buffers for unauthorized forwarding channels. Additionally, the client fails to verify `forwarded-tcpip` opens against registered forwards from `tcpip-forward` requests, as required by RFC 4254 section 7.2, enabling a malicious server to open forwarding channels for unauthorized addresses and ports.

A memory corruption flaw exists when handling APL (Address Prefix List) resource records during the process of serializing or writing a zone to disk. The issue stems from improper input validation and bounds checking of the `adflength` field. An attacker can trigger a stack-based buffer overflow by introducing a specially crafted APL record with an `adflength` larger than permitted for the address family into a zone. This can result in the overwrite of up to 111 attacker-controlled bytes on the stack, potentially leading to a denial of service or arbitrary code execution.

DIGEST-MD5 contains a NULL pointer dereference affecting both clients and servers. This issue occurs in the file lib/digest-md5/getsubopt.c when a known token is provided without an accompanying = character.