OpenSSH May Unexpectedly Activate GatewayPorts and Also May Disclose GSSAPI Credentials in Certain Cases
|
|
SecurityTracker Alert ID: 1014845
|
|
SecurityTracker URL: http://securitytracker.com/id?1014845
|
|
CVE Reference: CVE-2005-2797
, CVE-2005-2798
(Links to External Site)
|
Updated: Jan 10 2006
|
Original Entry Date: Sep 2 2005
|
Impact: Disclosure of authentication information, Host/resource access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): prior to 4.2
|
Description: Two vulnerabilities were reported in OpenSSH. GatewayPorts may be unexpectedly activated. GSSAPI authentication credentials may be disclosed to untrusted remote users.
If no listen address is specified for dynamic port forwardings (forwarding with the '-D' flag), GatewayPorts may be incorrectly activated.
As a result, a remote user may be able to access ports on the target system. This flaw was introduced in OpenSSH version 4.0.
GSSAPI
credentials can be delegated to users that can request to login with authentication methods other than GSSAPI authentication. As
a result, credentials may be inadvertently exposed to untrusted remote users in certain situations.
|
Impact: GatewayPorts may be unexpectedly activated.
GSSAPI authentication credentials may be disclosed to untrusted remote users.
|
Solution: The vendor has released a fixed version (4.2), available at:
http://openssh.org/
|
Vendor URL: www.openssh.org/ (Links to External Site)
|
Cause: Access control error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Fri, 2 Sep 2005 02:05:07 -0400
Subject: OpenSSH security vulnerabilities
|
- SECURITY: Fix a bug introduced in OpenSSH 4.0 that caused
GatewayPorts to be incorrectly activated for dynamic ("-D") port
forwardings when no listen address was explicitly specified.
- SECURITY: sshd in OpenSSH versions prior to 4.2 allow GSSAPI
credentials to be delegated to users who log in with methods
other than GSSAPI authentication (e.g. public key) when the
client requests it. This behaviour has been changed in OpenSSH
4.2 to only delegate credentials to users who authenticate
using the GSSAPI method. This eliminates the risk of credentials
being inadvertently exposed to an untrusted user/host (though
users should not activate GSSAPIDelegateCredentials to begin
with when the remote user or host is untrusted)
|
|
