152 lines
5.9 KiB
Text
152 lines
5.9 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-16:14.openssh Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: OpenSSH xauth(1) command injection
|
|
Category: contrib
|
|
Module: OpenSSH
|
|
Announced: 2016-03-16
|
|
Credits:
|
|
Affects: All supported versions of FreeBSD.
|
|
Corrected: 2016-03-12 23:53:20 UTC (stable/10, 10.2-STABLE)
|
|
2016-03-14 13:05:13 UTC (releng/10.3, 10.3-RC2)
|
|
2016-03-16 22:31:04 UTC (releng/10.2, 10.2-RELEASE-p14)
|
|
2016-03-16 22:30:56 UTC (releng/10.1, 10.1-RELEASE-p31)
|
|
2016-03-13 23:50:19 UTC (stable/9, 9.3-STABLE)
|
|
2016-03-16 22:30:03 UTC (releng/9.3, 9.3-RELEASE-p39)
|
|
CVE Name: CVE-2016-3115
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:https://security.FreeBSD.org/>.
|
|
|
|
I. Background
|
|
|
|
OpenSSH is an implementation of the SSH protocol suite, providing an
|
|
encrypted and authenticated transport for a variety of services,
|
|
including remote shell access. OpenSSH supports X11 forwarding,
|
|
allowing X11 applications on the server to connect to the client's
|
|
display.
|
|
|
|
When an X11 forwarding session is established, the OpenSSH daemon runs
|
|
the xauth tool with information provided by the client to create an
|
|
authority file on the server containing information that applications
|
|
need in order to connect to the client's X11 display.
|
|
|
|
II. Problem Description
|
|
|
|
Due to insufficient input validation in OpenSSH, a client which has
|
|
permission to establish X11 forwarding sessions to a server can
|
|
piggyback arbitrary shell commands on the data intended to be passed
|
|
to the xauth tool.
|
|
|
|
III. Impact
|
|
|
|
An attacker with valid credentials and permission to establish X11
|
|
forwarding sessions can bypass other restrictions which may have been
|
|
placed on their account, for instance using ForceCommand directives in
|
|
the server's configuration file.
|
|
|
|
IV. Workaround
|
|
|
|
Disable X11 forwarding globally by adding the following line to
|
|
/etc/ssh/sshd_config, before any Match blocks:
|
|
|
|
X11Forwarding no
|
|
|
|
then either restart the OpenSSH daemon or reboot the system.
|
|
|
|
Consult the sshd(8) and sshd_config(5) manual pages for additional
|
|
information on how to enable or disable X11 forwarding on a per-user
|
|
or per-key basis.
|
|
|
|
V. Solution
|
|
|
|
Perform one of the following:
|
|
|
|
1) Upgrade your vulnerable system to a supported FreeBSD stable or
|
|
release / security branch (releng) dated after the correction date,
|
|
then either restart the OpenSSH daemon or reboot the system.
|
|
|
|
2) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
# service sshd restart
|
|
|
|
3) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch https://security.FreeBSD.org/patches/SA-16:14/openssh-xauth.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-16:14/openssh-xauth.patch.asc
|
|
# gpg --verify openssh-xauth.patch.asc
|
|
|
|
b) Apply the patch. Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile the operating system using buildworld and installworld as
|
|
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
|
|
|
|
d) Either restart the OpenSSH daemon or reboot the system.
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/9/ r296780
|
|
releng/9.3/ r296953
|
|
stable/10/ r296781
|
|
releng/10.1/ r296954
|
|
releng/10.2/ r296955
|
|
releng/10.3/ r296853
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
<URL:http://www.openssh.com/txt/x11fwd.adv>
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3115>
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-16:14.openssh.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
|
|
iQIcBAEBCgAGBQJW6em1AAoJEO1n7NZdz2rnbQEP/2juxLcCzeHBUfVMBF6/HebX
|
|
Rt72Okdpkeht1FOVAnfJsG1l/zCJhS8RhKVG62KM9nK9Dl83NhLpobVMAhbDtzF/
|
|
Sr6f8UYZi22/0OlLsMBrYWeV1C8s6W/5z/d5OeomdHug6g6nFRi2g+tW6NImyU98
|
|
YdvgeFLcZKKFy2rbeA1lgXhC7TegKhr3ZbzisEFfkMR+eRYs+3lqaXMAr8RUy3XS
|
|
RNQBQ5WBfxR1Ld+ISeGjjVYpGU6PG8aY4qFsdGF2yWOBq4hk1NbrPFamVyAVd8g3
|
|
PsApqbvIsK8VjPAvxiwxOEfARRxIXsqOu8FcLwkpZ73/pj4vA8DjUSz9knhqhUyF
|
|
sCaOZxvOSJ5iU4JEB/Lva2jwNiY+6wQa6GXhCTlriV6PZZbhrAl5yzd9Z6jvYHsQ
|
|
sNx6a9/CjLw1L5Rthe3Ot3lVdnZeKq03tKjV88QFYj8+GhZFTnIjGAkPc+HIONdS
|
|
SxIhuHTrGGR4bj0XC7EC06ElSlt8oZjTpwKAFRetsJ3Z/DN5P0+HA6GR+5Nk/H2f
|
|
soP96pmrCNP3DPGNmTuzzGOYR7esTR0tC2d8ebit0kiPwcbQ8x2Bic1hdh2Dc7s8
|
|
vDAdxq3nPBHySvCiqt+G1faIA6HfECymhhqhC1bkJe046DQOEAdslhdNUhIBOE/x
|
|
yFRqqetd9LHhZBI9tGmF
|
|
=eliH
|
|
-----END PGP SIGNATURE-----
|