oss-sec mailing list archives
Re: CVE request - OpenSSH 6.9 PAM privilege separation vulnerabilities
From: Solar Designer <solar () openwall com>
Date: Wed, 12 Aug 2015 23:48:05 +0300
On Wed, Aug 12, 2015 at 09:50:10PM +0200, Moritz Jodeit wrote:
The vulnerable code for the two privsep issues was introduced with the merge of the FreeBSD PAM code in 2003: https://github.com/openssh/openssh-portable/commit/4f9f42a9bb6a6aa8f6100d873dc6344f2f9994de The user impersonation issue was fixed by the following commit: https://github.com/openssh/openssh-portable/commit/d4697fe9a28dab7255c60433e4dd23cf7fce8a8b While the use-after-free is fixed by this commit: https://github.com/openssh/openssh-portable/commit/5e75f5198769056089fb06c4d738ab0e5abc66f7
Thank you! Are systems with "keyboard interactive" and "challenge-response" authentication disabled (all of PAMAuthenticationViaKbdInt, KbdInteractiveAuthentication, and ChallengeResponseAuthentication, as applicable to a given sshd version, set to no) affected by these issues as well? The code appears to be specific to this mode, but it isn't immediately clear whether or not these configuration settings prevent the vulnerable code from being reached in the privsep monitor even when the privsep child is compromised. If the settings do not currently prevent the code from being reached (I hope they do), then this should be corrected as a hardening measure. And this is another reminder to all of us that enabling "keyboard interactive" or "challenge-response" authentication in sshd is extra risk, and it shouldn't be done unless necessary on a given system. Upstream sshd_config man page lists ChallengeResponseAuthentication as enabled by default, whereas Debian/Ubuntu (at least some versions) have it set to no in their default /etc/ssh/sshd_config (and enable UsePAM instead). Alexander
Current thread:
- CVE request - OpenSSH 6.9 PAM privilege separation vulnerabilities Moritz Jodeit (Aug 11)
- Re: CVE request - OpenSSH 6.9 PAM privilege separation vulnerabilities Adam Maris (Aug 12)
- Re: CVE request - OpenSSH 6.9 PAM privilege separation vulnerabilities Adam Maris (Aug 12)
- Re: CVE request - OpenSSH 6.9 PAM privilege separation vulnerabilities Solar Designer (Aug 12)
- Re: CVE request - OpenSSH 6.9 PAM privilege separation vulnerabilities Moritz Jodeit (Aug 12)
- Re: CVE request - OpenSSH 6.9 PAM privilege separation vulnerabilities Solar Designer (Aug 12)
- Re: CVE request - OpenSSH 6.9 PAM privilege separation vulnerabilities Moritz Jodeit (Aug 12)
- Re: CVE request - OpenSSH 6.9 PAM privilege separation vulnerabilities Solar Designer (Aug 13)
- Re: CVE request - OpenSSH 6.9 PAM privilege separation vulnerabilities Moritz Jodeit (Aug 12)
- Re: CVE request - OpenSSH 6.9 PAM privilege separation vulnerabilities cve-assign (Aug 21)
- Re: CVE request - OpenSSH 6.9 PAM privilege separation vulnerabilities Adam Maris (Aug 12)