Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 3 Jan 2012 05:56:57 +0400
From: Solar Designer <>
Subject: Re: speaking of DoS, openssh and dropbear (CVE-2006-1206)

On Tue, Jan 03, 2012 at 12:33:01AM +0100, Nico Golde wrote:
> P.S. if anyone has a clue on why that script still works with dropbear, even 
> though it already seems to implement per-ip based connection counting...

Does it still work?  I was not able to reproduce that.  I built Dropbear
2011.54, generated an RSA host key with "./dropbearkey -t rsa -f
dropbear_rsa_host_key" and started the service with "./dropbear -r
dropbear_rsa_host_key -p 2222".  Then I ran your DoS program with
"0:2222 10" on the command-line.  At first, it detected that Dropbear
would only allow 5 connections from the source address (indeed,
Dropbear's MAX_UNAUTH_PER_IP defaults to 5), and I was no longer able to
get the SSH version banner with "nc -v 0 2222" (the connection would be
closed immediately).  However, after a while I started being able to
connect with "nc" again, and Dropbear's log records only showed the DoS
program making 4 connections at a time, not 5 - I don't know why.  So I
hacked the program to make 6 connections at a time instead (changed
get_max_startups() to just "return 6;").  Then the DoS for connections
from became reliable, so I was able to reasonably test
connections from other source IP addresses, which I did.  "nc -s -v 0 2222" worked flawlessly (multiple times with no issue),
reporting "SSH-2.0-dropbear_2011.54".  Thus, the per-source limit
appeared to work as it should have.  Where's the problem?

(Of course, with the defaults of MAX_UNAUTH_CLIENTS 30 and
MAX_UNAUTH_PER_IP 5 it'd only take abusive connections from 6 IP
addresses to DoS the service, but that's expected.)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.