Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 13 Aug 2015 00:20:04 +0200
From: Moritz Jodeit <moritz@...efrostsecurity.de>
To: Solar Designer <solar@...nwall.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE request - OpenSSH 6.9 PAM privilege separation
 vulnerabilities

On 12.08.2015 22:48, Solar Designer wrote:
> On Wed, Aug 12, 2015 at 09:50:10PM +0200, Moritz Jodeit wrote:
>> The vulnerable code for the two privsep issues was introduced with the merge of the
>> FreeBSD PAM code in 2003:
>>
>> https://github.com/openssh/openssh-portable/commit/4f9f42a9bb6a6aa8f6100d873dc6344f2f9994de
>>
>> The user impersonation issue was fixed by the following commit:
>>
>> https://github.com/openssh/openssh-portable/commit/d4697fe9a28dab7255c60433e4dd23cf7fce8a8b
>>
>> While the use-after-free is fixed by this commit:
>>
>> https://github.com/openssh/openssh-portable/commit/5e75f5198769056089fb06c4d738ab0e5abc66f7
> 
> Thank you!
> 
> Are systems with "keyboard interactive" and "challenge-response"
> authentication disabled (all of PAMAuthenticationViaKbdInt,
> KbdInteractiveAuthentication, and ChallengeResponseAuthentication, as
> applicable to a given sshd version, set to no) affected by these issues
> as well?  The code appears to be specific to this mode, but it isn't
> immediately clear whether or not these configuration settings prevent
> the vulnerable code from being reached in the privsep monitor even when
> the privsep child is compromised.  If the settings do not currently
> prevent the code from being reached (I hope they do), then this should
> be corrected as a hardening measure.

As long as UsePAM is enabled in the configuration, all the PAM-related
monitor requests can be send to the monitor. This at least allows
triggering the use-after-free even if all the settings you mentioned
are set to "no". Not sure if a full authentication is possible in this
case though.

Moritz

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.