Re: CVE-2014-0475: glibc directory traversal in LC_* locale handling

[Florian Weimer <fw () deneb enyo de>]

* Solar Designer:

> The default sshd_config found in openssh-6.6p1.tar.gz does not list
> AcceptEnv, so presumably by default OpenSSH portable does not accept any
> environment variables.

I expected it to accept TERM, which is sort of unavoidable.

> However, apparently some distros override this safe default:

Yes, indeed.  There is clear user demand for this, especially from
organizations like Debian which have users in many different locales.

> Is there a supported way for distros to configure OpenSSH such that
> a number of environment variables would be accepted by default, but
> only as long as no command is forced?  This could be an acceptable
> tradeoff.

It is already possible to emulate this behavior with Match directives,
so this is probably not sufficient reason for OpenSSH changes.

However, on systems which follow POSIX strictly and do not share the
historic glibc bug, the glibc fix is does not apply, so some OpenSSH
changes to better support them might be necessary.

On the other hand, as long as you use a general-purpose, shell-backed
SSH implementation such as OpenSSH, it is difficult to completely rule
out code execution by proper configuration.  But the library-based SSH
implementations are likely less mature protocol-wise than OpenSSH,
unfortunately.