3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
79 lines
2.5 KiB
Text
79 lines
2.5 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-02:31 Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: openssh contains remote vulnerability
|
|
|
|
Category: core
|
|
Module: OpenSSH
|
|
Announced: 2002-07-15
|
|
Credits: ISS X-Force <xforce@ISS.net>
|
|
Theo DeRaadt <deraadt@OpenBSD.org>
|
|
Affects: FreeBSD-CURRENT between 2002-03-18 and 2002-06-25
|
|
Corrected: 2002-06-25 19:10:07 (HEAD)
|
|
FreeBSD only: NO
|
|
|
|
I. Background
|
|
|
|
OpenSSH is a free implementation of the SSH protocol suite, and
|
|
provides encrypted and authenticated remote login, file transfer and
|
|
command execution.
|
|
|
|
II. Problem Description
|
|
|
|
SSH clients and servers communicate by exchanging discrete messages
|
|
with a variable number of parameters. Due to the lack of sufficient
|
|
integrity checks in a portion of the server code responsible for
|
|
handling incoming SSH2_MSG_USERAUTH_INFO_RESPONSE messages, it was
|
|
possible for a malicious client to send a message that would cause the
|
|
server to overwrite portions of its memory with client-provided data.
|
|
|
|
III. Impact
|
|
|
|
An remote attacker using an SSH client modified to send carefully
|
|
crafted SSH2_MSG_USERAUTH_INFO_RESPONSE to the server could obtain
|
|
superuser privileges on the server.
|
|
|
|
Please note that this problem only affects FreeBSD-CURRENT. No
|
|
versions of FreeBSD-STABLE are or were ever vulnerable to this bug.
|
|
|
|
IV. Workaround
|
|
|
|
Do one of the following:
|
|
|
|
1) Disable SSH entirely.
|
|
|
|
2) Use a firewall to block incoming SSH connections from untrusted
|
|
hosts.
|
|
|
|
3) Add the following line to /etc/ssh/sshd_config, and restart sshd.
|
|
|
|
ChallengeResponseAuthentication no
|
|
|
|
Note that this will prevent the use of OPIE and similar challenge-
|
|
based authentication methods with SSH.
|
|
|
|
V. Solution
|
|
|
|
Update your system to the latest -CURRENT.
|
|
|
|
VI. Correction details
|
|
|
|
No correction details are provided in this advisory.
|
|
|
|
VII. References
|
|
|
|
<URL:http://www.openssh.com/txt/preauth.adv>
|
|
<URL:http://www.iss.net/security_center/static/9169.php>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.0.7 (FreeBSD)
|
|
Comment: FreeBSD: The Power To Serve
|
|
|
|
iQCVAwUBPTLiBVUuHi5z0oilAQFNAwQAoF1azTbsIiUc9O2VvIah+ueT5N3//qgf
|
|
ka+t5I5FtL8wFDKJXXf3JWx9lqf+JkscrL4SpMyY/OmL2wagvUeVHan+pE9dXRnK
|
|
YzFjdD8hP3GMiC1g0Dvwg9StoBs8kx+qP8dascS87Ql2QYo7aYcq6aageLSoy4Nj
|
|
iRHaJB2gZP8=
|
|
=nSnf
|
|
-----END PGP SIGNATURE-----
|