168 lines
6.2 KiB
Text
168 lines
6.2 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-14:24.sshd Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: Denial of service attack against sshd(8)
|
|
|
|
Category: contrib
|
|
Module: openssh
|
|
Announced: 2014-11-04
|
|
Credits: Konstantin Belousov
|
|
Affects: FreeBSD 9.1, 9.2 and 10.0.
|
|
Corrected: 2014-05-04 07:28:26 UTC (stable/10, 10.0-STABLE)
|
|
2014-11-04 23:31:17 UTC (releng/10.0, 10.0-RELEASE-p12)
|
|
2014-05-04 07:57:20 UTC (stable/9, 9.2-STABLE)
|
|
2014-11-04 23:33:17 UTC (releng/9.2, 9.2-RELEASE-p15)
|
|
2014-11-04 23:32:45 UTC (releng/9.1, 9.1-RELEASE-p22)
|
|
CVE Name: CVE-2014-8475
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:http://security.FreeBSD.org/>.
|
|
|
|
0. Revision History
|
|
|
|
v1.0 2014-11-04 Initial release.
|
|
v1.1 2014-11-06 Corrected "Credits" which was forgotten in the initial
|
|
release, and corrected manual patch steps in
|
|
"Solution" section.
|
|
|
|
I. Background
|
|
|
|
OpenSSH is an implementation of the SSH protocol suite, providing an
|
|
encrypted and authenticated transport for a variety of services,
|
|
including remote shell access. The sshd(8) daemon is the server side
|
|
of OpenSSH.
|
|
|
|
Heimdal is an implementation of Kerberos 5, which provides
|
|
authentication and single sign-on capability for many network
|
|
services, including OpenSSH.
|
|
|
|
II. Problem Description
|
|
|
|
Although OpenSSH is not multithreaded, when OpenSSH is compiled with
|
|
Kerberos support, the Heimdal libraries bring in the POSIX thread
|
|
library as a dependency. Due to incorrect library ordering while
|
|
linking sshd(8), symbols in the C library which are shadowed by the
|
|
POSIX thread library may not be resolved correctly at run time.
|
|
|
|
Note that this problem is specific to the FreeBSD build system and
|
|
does not affect other operating systems or the version of OpenSSH
|
|
available from the FreeBSD ports tree.
|
|
|
|
III. Impact
|
|
|
|
An incorrectly linked sshd(8) child process may deadlock while
|
|
handling an incoming connection. The connection may then time out or
|
|
be interrupted by the client, leaving the deadlocked sshd(8) child
|
|
process behind. Eventually, the sshd(8) parent process stops
|
|
accepting new connections.
|
|
|
|
An attacker may take advantage of this by repeatedly connecting and
|
|
then dropping the connection after having begun, but not completed,
|
|
the authentication process.
|
|
|
|
IV. Workaround
|
|
|
|
Possible workarounds include rebuilding sshd with Kerberos support
|
|
disabled or installing the security/openssh-portable package from the
|
|
FreeBSD ports tree or an official package repository.
|
|
|
|
Systems that do not run an OpenSSH server are not affected.
|
|
|
|
V. Solution
|
|
|
|
Perform one of the following:
|
|
|
|
1) Upgrade your vulnerable system to a supported FreeBSD stable or
|
|
release / security branch (releng) dated after the correction date.
|
|
|
|
2) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
|
|
3) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch http://security.FreeBSD.org/patches/SA-14:24/sshd.patch
|
|
# fetch http://security.FreeBSD.org/patches/SA-14:24/sshd.patch.asc
|
|
# gpg --verify sshd.patch.asc
|
|
|
|
b) Apply the patch. Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/sshd.patch
|
|
|
|
c) Recompile sshd. Execute the following commands as root:
|
|
|
|
# cd /usr/src/secure/usr.sbin/sshd
|
|
# make clean
|
|
# make obj && make depend && make && make install
|
|
|
|
4) Restart the affected service
|
|
|
|
To restart the affected service after updating the system, either
|
|
reboot the system or execute the following command as root:
|
|
|
|
# service sshd restart
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/9/ r265314
|
|
releng/9.1/ r274112
|
|
releng/9.2/ r274113
|
|
stable/10/ r265313
|
|
releng/10.0/ r274110
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:http://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
<other info on vulnerability>
|
|
|
|
<URL:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8475>
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:http://security.FreeBSD.org/advisories/FreeBSD-SA-14:24.sshd.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
|
|
iQIcBAEBCgAGBQJUXASgAAoJEO1n7NZdz2rnWyAQALEtSzPI5tZFRI79lLO3c3yM
|
|
6i7l6eqI7xUgh22M3w7oEDGEB/g51BJC+5haM9+CfrHrXDKMF1L3vQ29SUT3tNd/
|
|
abFaG2DZW9EbmG0pTsJco+looPOSIwWuAthGQAEkAU2073iX2ldo7MUcUzhTHu8d
|
|
0lIIoruefY92e4datwhlJT+6LLnCphPX1vRlo8N9hZrB/LO5+e/1c6wSK4lgIxEc
|
|
mMdoXx/heCtPiwL+O7iTqa2j4VzZDGy+v4jaFYIkI/WFvsYm+X+xzUxRiJIY+8o7
|
|
3LMtUSHXv+hlV8DVCjtbDevJt+h42K1CgL22vkgMvzyRMF8vM+Fk8Kvvfd3GL9d6
|
|
ZJGv1cNZarRwfbE5pB+4JaXHgFMj4lihmoJdKqgxYglMbrdtHZM4pzZ2xX0GlsPD
|
|
Hf4f1r+DugPc43s7lU9zus75NaVh/DZnFEHCTV7qIo0DD4Ia+T5lZnyfjNvbY7W+
|
|
q3Yz+bn3Uq9VdWW1WRpvaFItRuVbJGhGSpcVWl+QJHg9+plnZ0RQMmalkIgP6LBd
|
|
nhq5rWQlbwc3pM2RMefr29Yl3oCc5Ox/AUnV/DD+bEkFa61mlldtm2cRq3X6yaMW
|
|
sXRJ22DDHP10aMzlq0MkIQcbrgycAnoj6WEGBinv+lqh8SxHTkNi3pRI1w5lSh+k
|
|
075uI0Ka6HINuYqtRUaI
|
|
=C6El
|
|
-----END PGP SIGNATURE-----
|