M-095: OpenSSH Challenge Response Vulnerabilities Privacy and Legal Notice

CIAC INFORMATION BULLETIN

M-095: OpenSSH Challenge Response Vulnerabilities

[OpenSSH Security Advisory 2nd Revision]

 June 27, 2002 19:00 GMT
[Revised 9 July 2002]
PROBLEM: Two vulnerabilities exist in OpenSSH challenge response handling code. The first vulnerability is an integer overflow in the handling of the number of responses received during challenge response authentication. The second vulnerability is a buffer overflow involving the number of responses received during challenge response authentication.
AFFECTED VERSIONS: OpenSSH 2.3.1 through 3.3
PLATFORM: See CERT's Security Advisory CA-2002-18 for vendor updates and recommendations.
http://www.cert.org/advisories/CA-2002-18.html
DAMAGE: The vulnerabilities can be exploited remotely and allow an attacker to execute arbitrary code. These vulnerabilities may also cause a denial-of-service attack.
SOLUTION: Upgrade to OpenSSH 3.4, apply the patches recommended by OpenSSH, or see your platform vendor's particular recommendations.
VULNERABILITY
ASSESSMENT:		 The risk is HIGH. A remote attacker can execute code of choice with the privilege of running the sshd, often root.
LINKS:  
  CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/m-095.shtml
  ORIGINAL BULLETIN: http://openssh.org/txt/preauth.adv
  CERT BULLETIN: http://www.cert.org/advisories/CA-2002-18.html 
[***** Start OpenSSH Security Advisory 2nd Revision *****]

Subject: Revised OpenSSH Security Advisory (adv.iss)

This is the 4th revision of the Advisory.

1. Versions affected:

        Serveral versions of OpenSSH's sshd between 2.3.1 and 3.3
        contain an input validation error that can result in an
        integer overflow and privilege escalation.

        All versions between 2.3.1 and 3.3 contain a bug in the
        PAMAuthenticationViaKbdInt code.

        All versions between 2.9.9 and 3.3 contain a bug in the
        ChallengeResponseAuthentication code.

        OpenSSH 3.4 and later are not affected.

        OpenSSH 3.2 and later prevent privilege escalation if
        UsePrivilegeSeparation is enabled in sshd_config.  OpenSSH
        3.3 enables UsePrivilegeSeparation by default.

        Although some earlier versions are not affected upgrading
        to OpenSSH 3.4 is recommended, because OpenSSH 3.4 adds
        checks for a class of potential bugs.

2. Impact:

        This bug can be exploited remotely if
		ChallengeResponseAuthentication is enabled in sshd_config.
		This option is enabled by default on OpenBSD and other
		systems.

        Affected are at least systems supporting s/key over
        SSH protocol version 2 (OpenBSD, FreeBSD and NetBSD
        as well as other systems supporting s/key with SSH).
        Exploitablitly of systems using
		PAMAuthenticationViaKbdInt has not been verified.

3. Short-Term Solution:
	
    Disable ChallengeResponseAuthentication in sshd_config.

	and

	Disable PAMAuthenticationViaKbdInt in sshd_config.

	Alternatively you can prevent privilege escalation
	if you enable UsePrivilegeSeparation in sshd_config.

4. Solution:

	Upgrade to OpenSSH 3.4 or apply the following patches.

5. Credits:

	ISS.

Appendix:

A:

Index: auth2-chall.c
===================================================================
RCS file: /cvs/src/usr.bin/ssh/auth2-chall.c,v
retrieving revision 1.18
diff -u -r1.18 auth2-chall.c
--- auth2-chall.c	19 Jun 2002 00:27:55 -0000	1.18
+++ auth2-chall.c	26 Jun 2002 09:37:03 -0000
@@ -256,6 +256,8 @@
 
 	authctxt->postponed = 0;	/* reset */
 	nresp = packet_get_int();
+	if (nresp > 100)
+		fatal("input_userauth_info_response: nresp too big %u", nresp);
 	if (nresp > 0) {
 		response = xmalloc(nresp * sizeof(char*));
 		for (i = 0; i < nresp; i++)

B:

Index: auth2-pam.c
===================================================================
RCS file: /var/cvs/openssh/auth2-pam.c,v
retrieving revision 1.12
diff -u -r1.12 auth2-pam.c
--- auth2-pam.c	22 Jan 2002 12:43:13 -0000	1.12
+++ auth2-pam.c	26 Jun 2002 10:12:31 -0000
@@ -140,6 +140,15 @@
 	nresp = packet_get_int();	/* Number of responses. */
 	debug("got %d responses", nresp);
 
+
+	if (nresp != context_pam2.num_expected)
+		fatal("%s: Received incorrect number of responses "
+		    "(expected %u, received %u)", __func__, nresp,
+		    context_pam2.num_expected);
+
+	if (nresp > 100)
+		fatal("%s: too many replies", __func__);
+
 	for (i = 0; i < nresp; i++) {
 		int j = context_pam2.prompts[i];
 

[***** End OpenSSH Security Advisory 2nd Revision *****]
CIAC wishes to acknowledge the contributions of OpenBSD for the information contained in this bulletin.
DOE-CIRC can be contacted at: 
    Voice:          +1 866-941-2472 (7 x 24)
    E-mail:          doecirc@doecirc.energy.gov
    World Wide Web:  http://www.doecirc.energy.gov/