Skip to Content.
Sympa Menu

sm-security - Re: [SM-Security] Openssh remote root. for 3.6p1

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Craig Van Tassle <craig AT codestorm.org>
  • To: SM-Security AT lists.ibiblio.org
  • Cc:
  • Subject: Re: [SM-Security] Openssh remote root. for 3.6p1
  • Date: Tue, 16 Sep 2003 13:28:04 -0500

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Craig Van Tassle wrote:

| Ahh I guess I missed that one. Yea its right grsecurity would fix it but IMHO that really should be fixed in the code.
| Seth Woolley wrote:
|
| | I'm replying back on list since I found another link..., hope you don't
| | mind Niki.
| |
| | There was a reply on full-disclosure, but after analyzing it, I'm
| | hard-pressed to see anything inherently wrong with the code as long as
| | the buffer->offset is sane before it is passed to the function. I think
| | we're being taken for a ride. Niki and I talked in irc, and we'll keep
| | watching it for any movement. Anybody else is welcome to comment. I'm
| | seriously having my doubts though. This is one of those things that
| | PaX/grsecurity would prevent anyways, and priv-sep possibly, depending on
| | where the code was run. I'm also confused that the original post
| | mentioning 3.6p?, we're on 3.6 _point one_ p2 (3.6.1p2)... so I'm even
| | more confused. Without official word from Theo, I'm very inclined to
| | ignore.
| |
| | http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=106367504602779&w=2
| |
| | See that as well... the openssh people now know about the posts too, so
| | I'm going to watch that as well.
| |
| | Seth
| |
| | On Tue, 16 Sep 2003, Niki Guldbrand wrote:
| |
| | Hey Seth.
| |
| | What is all this about ??
| |
| | How serius is it ? (Have not heard anything other than what i have read
| | here.)
| |
| | And is it only patchlevel 1 that has it ?
| |
| |
| | Best Regards
| |
| | Niki
| |
| | On Tue, 2003-09-16 at 03:40, Seth Woolley wrote:
| |
| | >-----BEGIN PGP SIGNED MESSAGE-----
| | >Hash: SHA1
| | >
| | >New vuln? Full Disclosure has two threads so far:
| | >http://lists.netsys.com/pipermail/full-disclosure/2003-September/010103.html
| | >http://lists.netsys.com/pipermail/full-disclosure/2003-September/010135.html
| | >
| | >The second one is of note. See anything there that I don't? I'm waiting
| | >for a response to the second thread for confirmation.
| | >
| | >But we're on 3.6.1p2 right now... think we're safe?
| | >
| | >Seth
| | >
| | >On Mon, 15 Sep 2003, Craig Van Tassle wrote:
| | >
| | >>There has been some reports of a new vuln for openssh 3.6p1. As far as
| | >>I know the vuln is only for 3.6p1 and 3.6p2 is save.
| | >>
| | >>
| | >>_______________________________________________
| | >>SM-Security mailing list
| | >>SM-Security AT lists.ibiblio.org
| | >>http://lists.ibiblio.org/mailman/listinfo/sm-security
| | >
| | >- --
| | >Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
| | >Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
| | >Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
| | >
|
|
| _______________________________________________
| SM-Security mailing list
| SM-Security AT lists.ibiblio.org
| http://lists.ibiblio.org/mailman/listinfo/sm-security
|
|

This is the 1st revision of the Advisory.

This document can be found at: http://www.openssh.com/txt/buffer.adv

1. Versions affected:

~ All versions of OpenSSH's sshd prior to 3.7 contain a buffer
~ management error. It is uncertain whether this error is
~ potentially exploitable, however, we prefer to see bugs
~ fixed proactively.

2. Solution:

Upgrade to OpenSSH 3.7 or apply the following patch.

Appendix:

Index: buffer.c
===================================================================
RCS file: /cvs/src/usr.bin/ssh/buffer.c,v
retrieving revision 1.16
retrieving revision 1.17
diff -u -r1.16 -r1.17
- --- buffer.c 26 Jun 2002 08:54:18 -0000 1.16
+++ buffer.c 16 Sep 2003 03:03:47 -0000 1.17
@@ -69,6 +69,7 @@
~ void *
~ buffer_append_space(Buffer *buffer, u_int len)
~ {
+ u_int newlen;
~ void *p;

~ if (len > 0x100000)
@@ -98,11 +99,13 @@
~ goto restart;
~ }
~ /* Increase the size of the buffer and retry. */
- - buffer->alloc += len + 32768;
- - if (buffer->alloc > 0xa00000)
+ + newlen = buffer->alloc + len + 32768;
+ if (newlen > 0xa00000)
~ fatal("buffer_append_space: alloc %u not supported",
- - buffer->alloc);
- - buffer->buf = xrealloc(buffer->buf, buffer->alloc);
+ newlen);
+ buffer->buf = xrealloc(buffer->buf, newlen);
+ buffer->alloc = newlen;
~ goto restart;
~ /* NOTREACHED */
~ }

_______________________________________________
SM-Security mailing list
SM-Security AT lists.ibiblio.org
http://lists.ibiblio.org/mailman/listinfo/sm-security


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE/Z1YuBE4p9GMiP+MRAtwLAJ9D0fu2K3DBJ+iOg1/d+gQiUOsmjACfdz9f
RyNzMEqLYrJmk5FkZ5dXAuI=
=pGnp
-----END PGP SIGNATURE-----






Archive powered by MHonArc 2.6.24.

Top of Page