Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 25 Jul 2013 12:28:53 +0200
From: Sebastian Pipping <>
Subject: Re: CVE request: mysecureshell: local denial of service
 (or worse)

Hello Kurt,

On 25.07.2013 10:33, Kurt Seifried wrote:
> On 07/23/2013 11:19 AM, Sebastian Pipping wrote:
>> mysecureshell [1] is an SFTP-only shell to be used with sshd.
>> The latest release 1.31 makes use of shared memory with permissions
>> 666 to maintain 128 slots with one struct for each
>> connection/process. An unprivileged user can mark mark all
>> remaining slots as occupied (and optionally wait for remaining
>> clients to leave to block those slots, too).
>> To demonstrate the issue, I have written a small command line
>> tool. It's free software and can be found at [2].  Use it like
>> this:
>> # make cc -std=c99 -Wall -Wextra -pedantic local-dos.c -o
>> local-dos
>> # ./local-dos USAGE: ./local-dos (block|unblock|show)
>> # watch -n 1 -d ./local-dos block [..]
>> Besides the local DoS it might be possible to attack the call to
>> chdir, since that is reading from shared memory, too.
>> Any ideas on other attacks based on writing to that block of
>> shared memory?  File /bin/MySecureShell is mode 4755 setuid root if
>> that makes it more interesting :-)
>> [..]
>> [1]
>> [2]
> To reiterate: so I can confirm CVE assignments, and prevent duplicate
> assignments you *MUST* provide links to the code commits/vulnerable
> code. I don't have the time to go hunting through your source code for
> them. People need to start making better CVE requests, or you're not
> going to get CVEs from me.
> I think if I repeat this enough times it'll work.

Upstream tarball

Mode 0666 for shared memory, local denial of service

Guilty code


Inlined  (from SftpServer/SftpWho.c, lines 73 and after)
//try to join to existing shm
if ((shmid = shmget(key, sizeof(t_shm), 0)) == -1)
  if (create == 1)
      shmid = shmget(key, sizeof(t_shm), IPC_CREAT | IPC_EXCL | 0666);
      eraze = 1;

Please let me know if you need anything more.  Thanks for your time!



Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.