Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sun, 22 Dec 2013 19:51:29 +0100
From: Helmut Grohne <helmut@...divi.de>
To: oss-security@...ts.openwall.com
Subject: Re: [SECURITY] [DSA 2826-1] denyhosts security update

On Sun, Dec 22, 2013 at 07:26:15PM +0100, Yves-Alexis Perez wrote:
> Helmut Grohne discovered that denyhosts, a tool preventing SSH
> brute-force attacks, could be used to perform remote denial of service
> against the SSH daemon. Incorrectly specified regular expressions used
> to detect brute force attacks in authentication logs could be exploited
> by a malicious user to forge crafted login names in order to make
> denyhosts ban arbitrary IP addresses.

A bit of background on this issue:

I discovered the issue on the 19th of December ant contacted:
 * Debian security team
 * Maintainer of the Debian package: Kyle Willmon
 * Upstream: Phil Schwartz

Example exploit:

ssh -l 'Invalid user root from 123.123.123.123' 21.21.21.21

This causes a log line of the form

sshd[123]: input_userauth_request: invalid user Invalid user root from 123.123.123.123 [preauth]

and results in both IP addresses being blocked.

CVE-2013-6890 was assigned from the Debian pool.

The proposed solution is to tighten up the regular expressions for
matching log file entries. Specifically including the $ pattern to match
the end of log lines. For your convenience I attach the final patch.

The Debian security advisory is the initial public disclosure.

I am not aware of any upstream response to this issue and the last
denyhosts release is from 2008.

Helmut

Subject: address remote denial of service CVE-2013-6890
From: Helmut Grohne <helmut@...divi.de>

ssh -l 'Invalid user root from 123.123.123.123' 21.21.21.21

results in a log lines

sshd[123]: Invalid user Invalid user root from 123.123.123.123 from 21.21.21.21
sshd[123]: input_userauth_request: invalid user Invalid user root from 123.123.123.123 [preauth]
sshd[123]: Connection closed by 21.21.21.21 [preauth]

and causes denyhosts to block both ips 21.21.21.21 and 123.123.123.123.

This patch tightens the regular expressions used to avoid these and similar
injections.

Index: denyhosts-2.6/DenyHosts/regex.py
===================================================================
--- denyhosts-2.6.orig/DenyHosts/regex.py	2013-12-22 11:54:42.000000000 +0100
+++ denyhosts-2.6/DenyHosts/regex.py	2013-12-22 11:55:05.000000000 +0100
@@ -6,22 +6,22 @@
 
 #DATE_FORMAT_REGEX = re.compile(r"""(?P<month>[A-z]{3,3})\s*(?P<day>\d+)""")
 
-SSHD_FORMAT_REGEX = re.compile(r""".* (sshd.*:|\[sshd\]) (?P<message>.*)""")
+SSHD_FORMAT_REGEX = re.compile(r""".*? (sshd.*?:|\[sshd\]) (?P<message>.*)""")
 #SSHD_FORMAT_REGEX = re.compile(r""".* sshd.*: (?P<message>.*)""")
 
-FAILED_ENTRY_REGEX = re.compile(r"""Failed (?P<method>.*) for (?P<invalid>invalid user |illegal user )?(?P<user>.*?) .*from (::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})""")
+FAILED_ENTRY_REGEX = re.compile(r"""Failed (?P<method>\S*) for (?P<invalid>invalid user |illegal user )?(?P<user>.*) from (::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$""")
 
-FAILED_ENTRY_REGEX2 = re.compile(r"""(?P<invalid>(Illegal|Invalid)) user (?P<user>.*?) .*from (::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})""")
+FAILED_ENTRY_REGEX2 = re.compile(r"""(?P<invalid>(Illegal|Invalid)) user (?P<user>.*) from (::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$""")
 
-FAILED_ENTRY_REGEX3 = re.compile(r"""Authentication failure for (?P<user>.*) .*from (::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})""")
+FAILED_ENTRY_REGEX3 = None
 
-FAILED_ENTRY_REGEX4 = re.compile(r"""Authentication failure for (?P<user>.*) .*from (?P<host>.*)""")
+FAILED_ENTRY_REGEX4 = re.compile(r"""Authentication failure for (?P<user>.*) from (::ffff:)?(?P<host>\S+)$""")
 
-FAILED_ENTRY_REGEX5 = re.compile(r"""User (?P<user>.*) .*from (?P<host>.*) not allowed because none of user's groups are listed in AllowGroups$""")
+FAILED_ENTRY_REGEX5 = re.compile(r"""User (?P<user>.*) from (::ffff:)?(?P<host>\S+) not allowed because none of user's groups are listed in AllowGroups$""")
 
-FAILED_ENTRY_REGEX6 = re.compile(r"""Did not receive identification string .*from (::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})""")
+FAILED_ENTRY_REGEX6 = re.compile(r"""Did not receive identification string .*from (::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$""")
 
-FAILED_ENTRY_REGEX7 = re.compile(r"""User (?P<user>.*) from (?P<host>.*) not allowed because not listed in AllowUsers""")
+FAILED_ENTRY_REGEX7 = re.compile(r"""User (?P<user>.*) from (::ffff:)?(?P<host>\S+) not allowed because not listed in AllowUsers$""")
 
 
 # these are reserved for future versions
@@ -42,7 +42,7 @@
     FAILED_ENTRY_REGEX_MAP[i] = rx
 
 
-SUCCESSFUL_ENTRY_REGEX = re.compile(r"""Accepted (?P<method>.*) for (?P<user>.*?) from (::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})""")
+SUCCESSFUL_ENTRY_REGEX = re.compile(r"""Accepted (?P<method>\S+) for (?P<user>.*?) from (::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$""")
 
 TIME_SPEC_REGEX = re.compile(r"""(?P<units>\d*)\s*(?P<period>[smhdwy])?""")
 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ