Security bugs are reported here via bugzilla

[Craig Van Tassle <craig AT codestorm.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Craig Van Tassle wrote:

| Ahh I guess I missed that one.   Yea its right grsecurity would fix it 
but IMHO that really should be fixed in the code.
| Seth Woolley wrote:
|
| | I'm replying back on list since I found another link..., hope you don't
| | mind Niki.
| |
| | There was a reply on full-disclosure, but after analyzing it, I'm
| | hard-pressed to see anything inherently wrong with the code as long as
| | the buffer->offset is sane before it is passed to the function.  I think
| | we're being taken for a ride.  Niki and I talked in irc, and we'll keep
| | watching it for any movement.  Anybody else is welcome to comment.  I'm
| | seriously having my doubts though.  This is one of those things that
| | PaX/grsecurity would prevent anyways, and priv-sep possibly, 
depending on
| | where the code was run.  I'm also confused that the original post
| | mentioning 3.6p?, we're on 3.6 _point one_ p2 (3.6.1p2)...  so I'm even
| | more confused.  Without official word from Theo, I'm very inclined to
| | ignore.
| |
| | http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=106367504602779&w=2
| |
| | See that as well... the openssh people now know about the posts too, so
| | I'm going to watch that as well.
| |
| | Seth
| |
| | On Tue, 16 Sep 2003, Niki Guldbrand wrote:
| |
| | Hey Seth.
| |
| | What is all this about ??
| |
| | How serius is it ? (Have not heard anything other than what i have read
| | here.)
| |
| | And is it only patchlevel 1 that has it ?
| |
| |
| | Best Regards
| |
| | Niki
| |
| | On Tue, 2003-09-16 at 03:40, Seth Woolley wrote:
| |
| | >-----BEGIN PGP SIGNED MESSAGE-----
| | >Hash: SHA1
| | >
| | >New vuln?  Full Disclosure has two threads so far:
| | 
>http://lists.netsys.com/pipermail/full-disclosure/2003-September/010103.html
| | 
>http://lists.netsys.com/pipermail/full-disclosure/2003-September/010135.html
| | >
| | >The second one is of note.  See anything there that I don't?  I'm 
waiting
| | >for a response to the second thread for confirmation.
| | >
| | >But we're on 3.6.1p2 right now... think we're safe?
| | >
| | >Seth
| | >
| | >On Mon, 15 Sep 2003, Craig Van Tassle wrote:
| | >
| | >>There has been some reports of a new vuln for openssh 3.6p1.  As 
far as
| | >>I know the vuln is only for 3.6p1 and 3.6p2 is save.
| | >>
| | >>
| | >>_______________________________________________
| | >>SM-Security mailing list
| | >>SM-Security AT lists.ibiblio.org
| | >>http://lists.ibiblio.org/mailman/listinfo/sm-security
| | >
| | >- --
| | >Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
| | >Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
| | >Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
| | >
|
|
| _______________________________________________
| SM-Security mailing list
| SM-Security AT lists.ibiblio.org
| http://lists.ibiblio.org/mailman/listinfo/sm-security
|
|

This is the 1st revision of the Advisory.

This document can be found at:  http://www.openssh.com/txt/buffer.adv

1. Versions affected:

~        All versions of OpenSSH's sshd prior to 3.7 contain a buffer
~        management error.  It is uncertain whether this error is
~        potentially exploitable, however, we prefer to see bugs
~        fixed proactively.

2. Solution:

   Upgrade to OpenSSH 3.7 or apply the following patch.

Appendix:

Index: buffer.c
===================================================================
RCS file: /cvs/src/usr.bin/ssh/buffer.c,v
retrieving revision 1.16
retrieving revision 1.17
diff -u -r1.16 -r1.17
- --- buffer.c    26 Jun 2002 08:54:18 -0000    1.16
+++ buffer.c    16 Sep 2003 03:03:47 -0000    1.17
@@ -69,6 +69,7 @@
~ void *
~ buffer_append_space(Buffer *buffer, u_int len)
~ {
+    u_int newlen;
~     void *p;

~     if (len > 0x100000)
@@ -98,11 +99,13 @@
~         goto restart;
~     }
~     /* Increase the size of the buffer and retry. */
- -    buffer->alloc += len + 32768;
- -    if (buffer->alloc > 0xa00000)
+    
+    newlen = buffer->alloc + len + 32768;
+    if (newlen > 0xa00000)
~         fatal("buffer_append_space: alloc %u not supported",
- -            buffer->alloc);
- -    buffer->buf = xrealloc(buffer->buf, buffer->alloc);
+            newlen);
+    buffer->buf = xrealloc(buffer->buf, newlen);
+    buffer->alloc = newlen;
~     goto restart;
~     /* NOTREACHED */
~ }

_______________________________________________
SM-Security mailing list
SM-Security AT lists.ibiblio.org
http://lists.ibiblio.org/mailman/listinfo/sm-security


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE/Z1YuBE4p9GMiP+MRAtwLAJ9D0fu2K3DBJ+iOg1/d+gQiUOsmjACfdz9f
RyNzMEqLYrJmk5FkZ5dXAuI=
=pGnp
-----END PGP SIGNATURE-----