(FreeBSD Issues Fix) OpenSSH Bugs Let Remote Users Deny Service and Obtain Potentially Sensitive Timing Information and Let Local Users Gain Elevated Privileges
SecurityTracker Alert ID: 1039125|
SecurityTracker URL: http://securitytracker.com/id/1039125
(Links to External Site)
Date: Aug 10 2017
Denial of service via network, Disclosure of system information, Disclosure of user information, User access via local system|
Fix Available: Yes Vendor Confirmed: Yes |
Version(s): prior to 7.3|
Several vulnerabilities were reported in OpenSSH. A remote user can consume excessive CPU resources on the target system. A local user can obtain elevated privileges on the target system. A remote or local user can obtain potentially sensitive information on the target system.|
A remote user can submit specially crafted (long) passwords to the target server to cause the crypt(3) function to consume excessive CPU resources on the target system [CVE-2016-6515]. Tomas Kuthan (Oracle), Andres Rojas, and Javier Nieto separately reported this vulnerability.
A local user can set specially crafted environment variables to conduct attacks against the 'bin/login' process on systems where PAM is configured to read user-specified environment variables and 'sshd_config' is set with'UseLogin=yes' [CVE-2015-8325]. The sshd(8) portable version is affected. Shayan Sadigh reported this vulnerability.
A remote or local user may be able to observe timing differences in the ssh(1) and sshd(8) CBC padding oracle countermeasures. Jean Paul Degabriele, Kenny Paterson, Torben Hansen, and Martin Albrecht reported this vulnerability.
A remote or local user may be able to detect timing differences in the ssh(1) and sshd(8) MAC verification for Encrypt-then-MAC (EtM) mode transport MAC algorithms. No leakage has been observed. Jean Paul Degabriele, Kenny Paterson, Torben Hansen, and Martin Albrecht reported this vulnerability.
A remote user can consume excessive CPU resources on the target system.|
A local user can obtain elevated privileges on the target system.
A remote or local user can obtain potentially sensitive timing information.
FreeBSD has issued a fix for CVE-2016-6515.|
The FreeBSD advisory is available at:
Vendor URL: security.FreeBSD.org/advisories/FreeBSD-SA-17:06.openssh.asc (Links to External Site)
Access control error, Input validation error, State error|
|Underlying OS: UNIX (FreeBSD)|
|Underlying OS Comments: 10.3, 11.0, 11.1|
This archive entry is a follow-up to the message listed below.|
Source Message Contents
Subject: FreeBSD Security Advisory FreeBSD-SA-17:06.openssh|
-----BEGIN PGP SIGNED MESSAGE-----
FreeBSD-SA-17:06.openssh Security Advisory
The FreeBSD Project
Topic: OpenSSH Denial of Service vulnerability
Affects: All supported versions of FreeBSD.
Corrected: 2017-08-10 06:36:37 UTC (stable/11, 11.1-STABLE)
2017-08-10 06:59:07 UTC (releng/11.1, 11.1-RELEASE-p1)
2017-08-10 06:59:26 UTC (releng/11.0, 11.0-RELEASE-p12)
2017-08-10 06:36:37 UTC (stable/10, 10.3-STABLE)
2017-08-10 06:59:43 UTC (releng/10.3, 10.3-RELEASE-p21)
CVE Name: CVE-2016-6515
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
OpenSSH is an implementation of the SSH protocol suite, providing an
encrypted and authenticated transport for a variety of services,
including remote shell access.
OpenSSH supports a built-in password authentication method, which is
enabled with PasswordAuthentication. This option is disabled by
default on FreeBSD.
II. Problem Description
There is no limit on the password length.
A remote attacker may be able to cause an affected SSH server to use
excessive amount of CPU by sending very long passwords, when
PasswordAuthentication is enabled by the system administrator.
Disable PasswordAuthentication in /etc/ssh/sshd_config and restart
sshd. This is the default FreeBSD configuration.
Perform one of the following:
1) Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
Restart SSH service.
2) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
Restart SSH service.
3) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-17:06/openssh.patch
# fetch https://security.FreeBSD.org/patches/SA-17:06/openssh.patch.asc
# gpg --verify openssh.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart the SSH daemon, or reboot the system.
VI. Correction details
The following list contains the correction revision numbers for each
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
The latest revision of this advisory is available at
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.21 (FreeBSD)
-----END PGP SIGNATURE-----
firstname.lastname@example.org mailing list
To unsubscribe, send any mail to "email@example.com"