SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   OpenSSH Vendors:   OpenSSH.org
(OpenBSD Issues Fix for OpenBSD 2.9 and 3.1) Re: OpenSSH Buffer Overflow in Kerberos Ticket and AFS Token Processing Lets Local Users Execute Arbitrary Code With Root Level Permissions
SecurityTracker Alert ID:  1004144
SecurityTracker URL:  http://securitytracker.com/id/1004144
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Apr 24 2002
Impact:   Execution of arbitrary code via local system, Root access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2.2.0 - 3.1.0
Description:   A buffer overflow vulnerability has been reported in OpenSSH server. A local user can trigger the overflow to gain root level operating system access.

It is reported that the flaw exists in OpenSSH's Kerberos Ticket Granting Ticket (TGT) and/or AFS Token passing. According to the report, the GETSTRING macro in the radix_to_creds() function in the 'radix.c' file contains unchecked buffer operations. The affected buffers are:

creds->service
creds->instance
creds->realm
creds->pinst

A local user can apparently send a specially crafted, malformed request to:

1. pass Kerberos IV TGT
2. pass AFS Token

Apparently, the code clears the CREDENTIALS structure end of the auth_krb4_tgt() function (in file 'auth_krb4.c') but fails to clear user-supplied contents from the temp[] buffer in the radix_to_creds() function. When the server decodes the Kerberos ticket, the overflow can be triggered to cause arbitrary code to be executed with root level privileges.

The author of the report has provided a URL for some demonstration exploit code:

http://www.freeweb.hu/mantra/04_2002/tgt-x86Linux.tar.gz

Impact:   A remote user can execute arbitrary code on the server with root level privleges.
Solution:   The vendor has issued patches for OpenBSD 2.9 and 3.1.

For OpenBSD 3.1:

ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/001_sshafs.patch

For OpenBSD 2.9:

ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.9/common/024_sshafs.patch

A patch for OpenBSD 3.0 was mentioned in a previous alert and is available at:

ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/019_sshafs.patch

Vendor URL:  www.openssh.org/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  UNIX (OpenBSD)
Underlying OS Comments:  2.9, 3.1

Message History:   This archive entry is a follow-up to the message listed below.
Apr 19 2002 OpenSSH Buffer Overflow in Kerberos Ticket and AFS Token Processing Lets Local Users Execute Arbitrary Code With Root Level Permissions



 Source Message Contents

Subject:  OpenBSD Patches for 2.9 and 3.1


For OpenBSD 3.1:

001: SECURITY FIX: April 22, 2002

A local user can gain super-user privileges due to a buffer overflow in
sshd(8) if AFS has been configured on the system or if
KerberosTgtPassing or AFSTokenPassing has been enabled in the
sshd_config file. Ticket and token passing is not enabled by default.

A source code patch exists which remedies the problem:

ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/001_sshafs.patch



For OpenBSD 2.9:

024: SECURITY FIX: April 22, 2002

A local user can gain super-user privileges due to a buffer overflow in
sshd(8) if AFS has been configured on the system or if
KerberosTgtPassing or AFSTokenPassing has been enabled in the
sshd_config file. Ticket and token passing is not enabled by default.

A source code patch exists which remedies the problem:

ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.9/common/024_sshafs.patch


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC