exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

FreeBSD-SA-06-09.openssh.txt

FreeBSD-SA-06-09.openssh.txt
Posted Mar 3, 2006
Site freebsd.org

FreeBSD Security Advisory FreeBSD-SA-06:09.openssh - Because OpenSSH and OpenPAM have conflicting designs (one is event-driven while the other is callback-driven), it is necessary for OpenSSH to fork a child process to handle calls to the PAM framework. However, if the unprivileged child terminates while PAM authentication is under way, the parent process incorrectly believes that the PAM child also terminated. The parent process then terminates, and the PAM child is left behind. Due to the way OpenSSH performs internal accounting, these orphaned PAM children are counted as pending connections by the master OpenSSH server process. Once a certain number of orphans has accumulated, the master decides that it is overloaded and stops accepting client connections.

tags | advisory
systems | freebsd
advisories | CVE-2006-0883
SHA-256 | 012cb667b2bae94ec1b414c8de659b5091c2732abdfc4cd748a4a6a9557830cd

FreeBSD-SA-06-09.openssh.txt

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=============================================================================
FreeBSD-SA-06:09.openssh Security Advisory
The FreeBSD Project

Topic: Remote denial of service in OpenSSH

Category: contrib
Module: OpenSSH
Announced: 2006-03-01
Affects: FreeBSD 5.3 and 5.4
Corrected: 2006-03-01 14:19:48 UTC (RELENG_5, 5.5-PRERELEASE)
2006-03-01 14:21:01 UTC (RELENG_5_4, 5.4-RELEASE-p12)
2006-03-01 14:24:52 UTC (RELENG_5_3, 5.3-RELEASE-p27)
CVE Name: CVE-2006-0883

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit
<URL:http://www.freebsd.org/security/>.

I. Background

OpenSSH is an implementation of the SSH protocol suite, providing an
encrypted, authenticated transport for a variety of services,
including remote shell access.

Privilege separation is a mechanism used by OpenSSH to protect itself
against possible future vulnerabilities. It works by splitting the
server process in two: the child process drops its privileges and
carries on the conversation with the client, while the parent retains
its privileges, monitors the child, and performs privileged operations
on behalf of the child when it is satisified that everything is in
order. Privilege separation is enabled by default in FreeBSD.

OpenPAM is an implementation of the PAM framework, which allows the
use of loadable modules to implement user authentication and session
management in a manner defined by the administrator. It is used by
OpenSSH and numerous other applications in FreeBSD to provide a
consistent and configurable authentication system.

II. Problem Description

Because OpenSSH and OpenPAM have conflicting designs (one is event-
driven while the other is callback-driven), it is necessary for
OpenSSH to fork a child process to handle calls to the PAM framework.
However, if the unprivileged child terminates while PAM authentication
is under way, the parent process incorrectly believes that the PAM
child also terminated. The parent process then terminates, and the
PAM child is left behind.

Due to the way OpenSSH performs internal accounting, these orphaned
PAM children are counted as pending connections by the master OpenSSH
server process. Once a certain number of orphans has accumulated, the
master decides that it is overloaded and stops accepting client
connections.

III. Impact

By repeatedly connecting to a vulnerable server, waiting for a
password prompt, and closing the connection, an attacker can cause
OpenSSH to stop accepting client connections until the system restarts
or an administrator manually kills the orphaned PAM processes.

IV. Workaround

The following command will show a list of orphaned PAM processes:

# pgrep -lf '\[pam\]'

The following command will kill orphaned PAM processes:

# pkill -f '\[pam\]'

To prevent OpenSSH from leaving orphaned PAM processes behind, perform
one of the following:

1) Disable PAM authentication in OpenSSH. Users will still be able to
log in using their Unix password, OPIE or SSH keys.

To do this, execute the following commands as root:

# echo 'UsePAM no' >>/etc/ssh/sshd_config
# /etc/rc.d/sshd restart

2) If disabling PAM is not an option - if, for instance, you use
RADIUS authentication, or store user passwords in an SQL database -
you may instead disable privilege separation. However, this may
leave OpenSSH vulnerable to hitherto unknown bugs, and should be
considered a last resort.

To do this, execute the following commands as root:

# echo 'UsePrivilegeSeparation no' >>/etc/ssh/sshd_config
# /etc/rc.d/sshd restart

V. Solution

Perform one of the following:

1) Upgrade your vulnerable system to 5-STABLE or to the RELENG_5_4 or
RELENG_5_3 security branch dated after the correction date.

2) To patch your present system:

The following patches have been verified to apply to FreeBSD 5.3 and
5.4 systems.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:09/openssh.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:09/openssh.patch.asc

b) Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch
# cd /usr/src/secure/lib/libssh
# make obj && make depend && make && make install
# cd /usr/src/secure/usr.sbin/sshd
# make obj && make depend && make && make install
# /etc/rc.d/sshd restart

VI. Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

Branch Revision
Path
- -------------------------------------------------------------------------
RELENG_5
src/crypto/openssh/auth-pam.c 1.14.2.1
src/crypto/openssh/ssh_config 1.25.2.1
src/crypto/openssh/ssh_config.5 1.15.2.1
src/crypto/openssh/sshd_config 1.40.2.1
src/crypto/openssh/sshd_config.5 1.21.2.1
src/crypto/openssh/version.h 1.27.2.1
RELENG_5_4
src/UPDATING 1.342.2.24.2.21
src/sys/conf/newvers.sh 1.62.2.18.2.17
src/crypto/openssh/auth-pam.c 1.14.6.1
src/crypto/openssh/ssh_config 1.25.6.1
src/crypto/openssh/ssh_config.5 1.15.6.1
src/crypto/openssh/sshd_config 1.40.6.1
src/crypto/openssh/sshd_config.5 1.21.6.1
src/crypto/openssh/version.h 1.27.6.1
RELENG_5_3
src/UPDATING 1.342.2.13.2.30
src/sys/conf/newvers.sh 1.62.2.15.2.32
src/crypto/openssh/auth-pam.c 1.14.4.1
src/crypto/openssh/ssh_config 1.25.4.1
src/crypto/openssh/ssh_config.5 1.15.4.1
src/crypto/openssh/sshd_config 1.40.4.1
src/crypto/openssh/sshd_config.5 1.21.4.1
src/crypto/openssh/version.h 1.27.4.1
- -------------------------------------------------------------------------

VII. References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=248125
http://bugzilla.mindrot.org/show_bug.cgi?id=839
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0883

The latest revision of this advisory is available at
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:09.openssh.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (FreeBSD)

iD8DBQFEBbOEFdaIBMps37IRAghrAJ93wcvG5uGATpA8jDIQE0Dn8fF8iQCglz6r
DaXFHxKA7Xhc33smtuMlWNU=
=87jf
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close