Re: CVE request - OpenSSH 6.9 PAM privilege separation vulnerabilities

[Moritz Jodeit <moritz () bluefrostsecurity de>]

On 12.08.2015 22:48, Solar Designer wrote:
> On Wed, Aug 12, 2015 at 09:50:10PM +0200, Moritz Jodeit wrote:
> > The vulnerable code for the two privsep issues was introduced with the merge of the
> > FreeBSD PAM code in 2003:
> >
> > https://github.com/openssh/openssh-portable/commit/4f9f42a9bb6a6aa8f6100d873dc6344f2f9994de
> >
> > The user impersonation issue was fixed by the following commit:
> >
> > https://github.com/openssh/openssh-portable/commit/d4697fe9a28dab7255c60433e4dd23cf7fce8a8b
> >
> > While the use-after-free is fixed by this commit:
> >
> > https://github.com/openssh/openssh-portable/commit/5e75f5198769056089fb06c4d738ab0e5abc66f7
>
> Thank you!
>
> Are systems with "keyboard interactive" and "challenge-response"
> authentication disabled (all of PAMAuthenticationViaKbdInt,
> KbdInteractiveAuthentication, and ChallengeResponseAuthentication, as
> applicable to a given sshd version, set to no) affected by these issues
> as well?  The code appears to be specific to this mode, but it isn't
> immediately clear whether or not these configuration settings prevent
> the vulnerable code from being reached in the privsep monitor even when
> the privsep child is compromised.  If the settings do not currently
> prevent the code from being reached (I hope they do), then this should
> be corrected as a hardening measure.

As long as UsePAM is enabled in the configuration, all the PAM-related
monitor requests can be send to the monitor. This at least allows
triggering the use-after-free even if all the settings you mentioned
are set to "no". Not sure if a full authentication is possible in this
case though.

Moritz