SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   OpenSSH Vendors:   OpenSSH.org
(Caldera Issues Fix for OpenLinux) OpenSSH Buffer Overflow in Kerberos Ticket and AFS Token Processing Lets Local Users Execute Arbitrary Code With Root Level Permissions
SecurityTracker Alert ID:  1004305
SecurityTracker URL:  http://securitytracker.com/id/1004305
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  May 16 2002
Impact:   Execution of arbitrary code via local system, Root access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2.2.0 - 3.1.0
Description:   A buffer overflow vulnerability has been reported in OpenSSH server. A local user can trigger the overflow to gain root level operating system access.

It is reported that the flaw exists in OpenSSH's Kerberos Ticket Granting Ticket (TGT) and/or AFS Token passing. According to the report, the GETSTRING macro in the radix_to_creds() function in the 'radix.c' file contains unchecked buffer operations. The affected buffers are:

creds->service
creds->instance
creds->realm
creds->pinst

A local user can apparently send a specially crafted, malformed request to:

1. pass Kerberos IV TGT
2. pass AFS Token

Apparently, the code clears the CREDENTIALS structure end of the auth_krb4_tgt() function (in file 'auth_krb4.c') but fails to clear user-supplied contents from the temp[] buffer in the radix_to_creds() function. When the server decodes the Kerberos ticket, the overflow can be triggered to cause arbitrary code to be executed with root level privileges.

The author of the report has provided a URL for some demonstration exploit code:

http://www.freeweb.hu/mantra/04_2002/tgt-x86Linux.tar.gz

Impact:   A remote user can execute arbitrary code on the server with root level privleges.
Solution:   The vendor has released a fix.

For OpenLinux 3.1.1 Server:

Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS

Packages:

f9a494af5e0e6a8eec419f8f94087f7e openssh-2.9p2-6.i386.rpm
b9fcc6352bc4c65f63cda1b0caa2b89c openssh-askpass-2.9p2-6.i386.rpm
ff4a5bc7e7b1d4fd3f79c647d11d9162 openssh-server-2.9p2-6.i386.rpm

To install:

rpm -Fvh openssh-2.9p2-6.i386.rpm
rpm -Fvh openssh-askpass-2.9p2-6.i386.rpm
rpm -Fvh openssh-server-2.9p2-6.i386.rpm

Source Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS

Source Packages:

ab3e90f4e70fc3eecd7e456fa2c2a97e openssh-2.9p2-6.src.rpm


For OpenLinux 3.1.1 Workstation:

Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/RPMS

Packages:

3406e8a3e55b52b2eb3e7644327d783c openssh-2.9p2-6.i386.rpm
e57817246b56ffdf0322be8afcec08ae openssh-askpass-2.9p2-6.i386.rpm

To install:

rpm -Fvh openssh-2.9p2-6.i386.rpm
rpm -Fvh openssh-askpass-2.9p2-6.i386.rpm

Source Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/SRPMS

Source Packages:

fde335f6bce93b3a3bf3cc20d8231849 openssh-2.9p2-6.src.rpm


For OpenLinux 3.1 Server:

Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS

Packages:

41f489ad60ed068a2a027589ca49e6ea openssh-2.9p2-6.i386.rpm
c4b8c1e011708a9e8fa04d927387bde5 openssh-askpass-2.9p2-6.i386.rpm
3bbb580c64ba83efaeefac20d891148f openssh-server-2.9p2-6.i386.rpm

To install:

rpm -Fvh openssh-2.9p2-6.i386.rpm
rpm -Fvh openssh-askpass-2.9p2-6.i386.rpm
rpm -Fvh openssh-server-2.9p2-6.i386.rpm

Source Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS

Source Packages:

1c30685cf106f5ee05ec201cd55044f8 openssh-2.9p2-6.src.rpm


For OpenLinux 3.1 Workstation:

Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RPMS

Packages:

45502ddfa3d9bc67eefc2ec6a6bd992a openssh-2.9p2-6.i386.rpm
c5bedc4946ee432f66255161ba61bbf5 openssh-askpass-2.9p2-6.i386.rpm

To install:

rpm -Fvh openssh-2.9p2-6.i386.rpm
rpm -Fvh openssh-askpass-2.9p2-6.i386.rpm

Source Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/SRPMS

Source Packages:

5ddea2209f395da08ca715a128e5485a openssh-2.9p2-6.src.rpm

Vendor URL:  www.openssh.org/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Caldera/SCO)
Underlying OS Comments:  OpenLinux Server and Workstation; 3.1, 3.1.1

Message History:   This archive entry is a follow-up to the message listed below.
Apr 19 2002 OpenSSH Buffer Overflow in Kerberos Ticket and AFS Token Processing Lets Local Users Execute Arbitrary Code With Root Level Permissions



 Source Message Contents

Subject:  Security Update: [CSSA-2002-022.0] Linux: OpenSSH ticket and token passing buffer overflow


--B4IIlcmfBL/1gGOG
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

To: bugtraq@securityfocus.com announce@lists.caldera.com security-alerts@linuxsecurity.com

______________________________________________________________________________

		Caldera International, Inc.  Security Advisory

Subject:		Linux: OpenSSH ticket and token passing buffer overflow
Advisory number: 	CSSA-2002-022.0
Issue date: 		2002 May 15
Cross reference:
______________________________________________________________________________


1. Problem Description

	A buffer overflow exists in OpenSSH if KerberosTgtPassing or
	AFSTokenPassing has been enabled in the sshd_config file. A
	malicious user, possibly remote, could use this vulnerability
	to gain privileged access to the system.


2. Vulnerable Supported Versions

	System				Package
	----------------------------------------------------------------------

	OpenLinux 3.1.1 Server		prior to openssh-2.9p2-6.i386.rpm
					prior to openssh-askpass-2.9p2-6.i386.rpm
					prior to openssh-server-2.9p2-6.i386.rpm

	OpenLinux 3.1.1 Workstation	prior to openssh-2.9p2-6.i386.rpm
					prior to openssh-askpass-2.9p2-6.i386.rpm

	OpenLinux 3.1 Server		prior to openssh-2.9p2-6.i386.rpm
					prior to openssh-askpass-2.9p2-6.i386.rpm
					prior to openssh-server-2.9p2-6.i386.rpm

	OpenLinux 3.1 Workstation	prior to openssh-2.9p2-6.i386.rpm
					prior to openssh-askpass-2.9p2-6.i386.rpm


3. Solution

	The proper solution is to install the latest packages.


4. OpenLinux 3.1.1 Server

	4.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS

	4.2 Packages

	f9a494af5e0e6a8eec419f8f94087f7e	openssh-2.9p2-6.i386.rpm
	b9fcc6352bc4c65f63cda1b0caa2b89c	openssh-askpass-2.9p2-6.i386.rpm
	ff4a5bc7e7b1d4fd3f79c647d11d9162	openssh-server-2.9p2-6.i386.rpm

	4.3 Installation

	rpm -Fvh openssh-2.9p2-6.i386.rpm
	rpm -Fvh openssh-askpass-2.9p2-6.i386.rpm
	rpm -Fvh openssh-server-2.9p2-6.i386.rpm

	4.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS

	4.5 Source Packages

	ab3e90f4e70fc3eecd7e456fa2c2a97e	openssh-2.9p2-6.src.rpm


5. OpenLinux 3.1.1 Workstation

	5.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/RPMS

	5.2 Packages

	3406e8a3e55b52b2eb3e7644327d783c	openssh-2.9p2-6.i386.rpm
	e57817246b56ffdf0322be8afcec08ae	openssh-askpass-2.9p2-6.i386.rpm

	5.3 Installation

	rpm -Fvh openssh-2.9p2-6.i386.rpm
	rpm -Fvh openssh-askpass-2.9p2-6.i386.rpm

	5.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/SRPMS

	5.5 Source Packages

	fde335f6bce93b3a3bf3cc20d8231849	openssh-2.9p2-6.src.rpm


6. OpenLinux 3.1 Server

	6.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS

	6.2 Packages

	41f489ad60ed068a2a027589ca49e6ea	openssh-2.9p2-6.i386.rpm
	c4b8c1e011708a9e8fa04d927387bde5	openssh-askpass-2.9p2-6.i386.rpm
	3bbb580c64ba83efaeefac20d891148f	openssh-server-2.9p2-6.i386.rpm

	6.3 Installation

	rpm -Fvh openssh-2.9p2-6.i386.rpm
	rpm -Fvh openssh-askpass-2.9p2-6.i386.rpm
	rpm -Fvh openssh-server-2.9p2-6.i386.rpm

	6.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS

	6.5 Source Packages

	1c30685cf106f5ee05ec201cd55044f8	openssh-2.9p2-6.src.rpm


7. OpenLinux 3.1 Workstation

	7.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RPMS

	7.2 Packages

	45502ddfa3d9bc67eefc2ec6a6bd992a	openssh-2.9p2-6.i386.rpm
	c5bedc4946ee432f66255161ba61bbf5	openssh-askpass-2.9p2-6.i386.rpm

	7.3 Installation

	rpm -Fvh openssh-2.9p2-6.i386.rpm
	rpm -Fvh openssh-askpass-2.9p2-6.i386.rpm

	7.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/SRPMS

	7.5 Source Packages

	5ddea2209f395da08ca715a128e5485a	openssh-2.9p2-6.src.rpm


8. References

	Specific references for this advisory:
		none


	Caldera OpenLinux security resources:
		http://www.caldera.com/support/security/index.html

	Caldera UNIX security resources:
		http://stage.caldera.com/support/security/

	This security fix closes Caldera incidents sr863642, fz520794
	and erg712034.


9. Disclaimer

	Caldera International, Inc. is not responsible for the misuse
	of any of the information we provide on this website and/or
	through our security advisories. Our advisories are a service
	to our customers intended to promote secure installation and
	use of Caldera products.


10. Acknowledgements

	Marcell Fodor discovered and researched this vulnerability.

______________________________________________________________________________

--B4IIlcmfBL/1gGOG
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (SCO_SV)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAjzi9P0ACgkQbluZssSXDTEYsgCgsvb+FFblriS7Cx3CHpttoMIv
Fs8AnAu9ImhtbFsJZd8aT1CMaLJSU8Se
=44Zg
-----END PGP SIGNATURE-----

--B4IIlcmfBL/1gGOG--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC