I have been following these reports this afternoon. I was waiting for a good
report to share, and they just arrived. I just sent the FreeBSD security
advisory to the msusec mailing list. Here is the OpenBSD advisory.
From: Chris Wysopal <[log in to unmask]>
Subject: [VulnWatch] OpenSSH Security Advisory: buffer.adv
List: openbsd-misc
Subject: OpenSSH Security Advisory: buffer.adv
From: Markus Friedl <markus () openbsd ! org>
Date: 2003-09-16 12:32:15
[Download message RAW]
This is the 1st revision of the Advisory.
This document can be found at: http://www.openssh.com/txt/buffer.adv
1. Versions affected:
All versions of OpenSSH's sshd prior to 3.7 contain a buffer
management error. It is uncertain whether this error is
potentially exploitable, however, we prefer to see bugs
fixed proactively.
2. Solution:
Upgrade to OpenSSH 3.7 or apply the following patch.
Appendix:
Index: buffer.c
===================================================================
RCS file: /cvs/src/usr.bin/ssh/buffer.c,v
retrieving revision 1.16
retrieving revision 1.17
diff -u -r1.16 -r1.17
--- buffer.c 26 Jun 2002 08:54:18 -0000 1.16
+++ buffer.c 16 Sep 2003 03:03:47 -0000 1.17
@@ -69,6 +69,7 @@
void *
buffer_append_space(Buffer *buffer, u_int len)
{
+ u_int newlen;
void *p;
if (len > 0x100000)
@@ -98,11 +99,13 @@
goto restart;
}
/* Increase the size of the buffer and retry. */
- buffer->alloc += len + 32768;
- if (buffer->alloc > 0xa00000)
+
+ newlen = buffer->alloc + len + 32768;
+ if (newlen > 0xa00000)
fatal("buffer_append_space: alloc %u not supported",
- buffer->alloc);
- buffer->buf = xrealloc(buffer->buf, buffer->alloc);
+ newlen);
+ buffer->buf = xrealloc(buffer->buf, newlen);
+ buffer->alloc = newlen;
goto restart;
/* NOTREACHED */
}
On Tue, Sep 16, 2003 at 01:59:38PM -0400, Uwe Rossbach wrote:
> Does anyone have a confirmation of this slashdot story and Full
> Disclosure posting. The only thing I noticed is that there is a new
> openSSH version (3.7) as of 5 am today on the server in Canada. The
> exploit looks for root access by trying a large number of accounts and
> connection requests. Leading to denial of service if not successful. Uwe
> Rossbach
>
>
>
> "
>
>
> [Full-Disclosure] new ssh exploit?
>
> *christopher neitzert * [log in to unmask] <mailto:chris%40neitzert.com>
> /Mon, 15 Sep 2003 13:48:34 -0400/
>
> * Previous message: [Full-Disclosure] new ssh exploit?
> <http://lists.netsys.com/pipermail/full-disclosure/2003-September/010103.html>
> * Next message: [Full-Disclosure] new ssh exploit?
> <http://lists.netsys.com/pipermail/full-disclosure/2003-September/010120.html>
> * *Messages sorted by:* [ date ]
> <http://lists.netsys.com/pipermail/full-disclosure/2003-September/date.html#10116>
> [ thread ]
> <http://lists.netsys.com/pipermail/full-disclosure/2003-September/thread.html#10116>
> [ subject ]
> <http://lists.netsys.com/pipermail/full-disclosure/2003-September/subject.html#10116>
> [ author ]
> <http://lists.netsys.com/pipermail/full-disclosure/2003-September/author.html#10116>
>
>
> ------------------------------------------------------------------------
>
> --=-sz+BJAPCz1yL37OtGOWm
> Content-Type: text/plain
> Content-Transfer-Encoding: quoted-printable
>
> More on this;
>
> The systems in question are FreeBSD, RedHat, Gentoo, and Debian all
> running the latest versions of OpenSSH.
>
> The attack makes an enormous amount of ssh connections and attempts
> various offsets until it finds one that works permitting root login.
>
> I have received numerous messages from folks requesting anonymity or
> direct-off-list-reply confirming this exploit;
>
> The suggestions I have heard are:
>
> Turn off SSH and
>
> 1. upgrade to lsh.
>
> or
>
> 2. add explicit rules to your edge devices allowing ssh from only-known
> hosts.
>
> or
>
> 3. put ssh behind a VPN on RFC-1918 space.
>
> thanks.
>
>
>
>
> On Mon, 2003-09-15 at 12:02, christopher neitzert wrote:
> >/ Does anyone know of or have source related to a new, and unpublished ssh
> />/ exploit? An ISP I work with has filtered all SSH connections due to
> />/ several root level incidents involving ssh. Any information is
> />/ appreciated.
> />/=20
> />/=20
> /--=20
> Christopher Neitzert - GPG Key ID: 7DCC491B
>
> --=-sz+BJAPCz1yL37OtGOWm
> Content-Type: application/pgp-signature; name=signature.asc
> Content-Description: This is a digitally signed message part
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.2 (GNU/Linux)
>
> iD8DBQA/ZftxAXFK233MSRsRAuSUAJ9jv5aBH2wVpgv6r4sC4NaA3dnXrACglaxX
> +fZt/6hiarcw2KVtQq1i0Nk=
> =MaEF
> -----END PGP SIGNATURE-----
>
> --=-sz+BJAPCz1yL37OtGOWm--
>
>
>
> ------------------------------------------------------------------------
>
> * Previous message: [Full-Disclosure] new ssh exploit?
> <http://lists.netsys.com/pipermail/full-disclosure/2003-September/010103.html>
> * Next message: [Full-Disclosure] new ssh exploit?
> <http://lists.netsys.com/pipermail/full-disclosure/2003-September/010120.html>
> * *Messages sorted by:* [ date ]
> <http://lists.netsys.com/pipermail/full-disclosure/2003-September/date.html#10116>
> [ thread ]
> <http://lists.netsys.com/pipermail/full-disclosure/2003-September/thread.html#10116>
> [ subject ]
> <http://lists.netsys.com/pipermail/full-disclosure/2003-September/subject.html#10116>
> [ author ]
> <http://lists.netsys.com/pipermail/full-disclosure/2003-September/author.html#10116>
|
