Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2006.0155 -- [FreeBSD][NetBSD]
Remote denial of service in OpenSSH
2 March 2006
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: OpenSSH
Publisher: FreeBSD
Operating System: FreeBSD
NetBSD
Impact: Denial of Service
Access: Remote/Unauthenticated
CVE Names: CVE-2006-0883
Original Bulletin:
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:09.openssh.asc
Comment: This vulnerability occurs when OpenSSH is used with OpenPAM, which
is the default PAM system on FreeBSD and NetBSD.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=============================================================================
FreeBSD-SA-06:09.openssh Security Advisory
The FreeBSD Project
Topic: Remote denial of service in OpenSSH
Category: contrib
Module: OpenSSH
Announced: 2006-03-01
Affects: FreeBSD 5.3 and 5.4
Corrected: 2006-03-01 14:19:48 UTC (RELENG_5, 5.5-PRERELEASE)
2006-03-01 14:21:01 UTC (RELENG_5_4, 5.4-RELEASE-p12)
2006-03-01 14:24:52 UTC (RELENG_5_3, 5.3-RELEASE-p27)
CVE Name: CVE-2006-0883
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit
<URL:http://www.freebsd.org/security/>.
0. Revision History
v1.0 2006-03-01 Initial release.
v1.1 2006-03-01 Corrected workaround instructions.
I. Background
OpenSSH is an implementation of the SSH protocol suite, providing an
encrypted, authenticated transport for a variety of services,
including remote shell access.
Privilege separation is a mechanism used by OpenSSH to protect itself
against possible future vulnerabilities. It works by splitting the
server process in two: the child process drops its privileges and
carries on the conversation with the client, while the parent retains
its privileges, monitors the child, and performs privileged operations
on behalf of the child when it is satisified that everything is in
order. Privilege separation is enabled by default in FreeBSD.
OpenPAM is an implementation of the PAM framework, which allows the
use of loadable modules to implement user authentication and session
management in a manner defined by the administrator. It is used by
OpenSSH and numerous other applications in FreeBSD to provide a
consistent and configurable authentication system.
II. Problem Description
Because OpenSSH and OpenPAM have conflicting designs (one is event-
driven while the other is callback-driven), it is necessary for
OpenSSH to fork a child process to handle calls to the PAM framework.
However, if the unprivileged child terminates while PAM authentication
is under way, the parent process incorrectly believes that the PAM
child also terminated. The parent process then terminates, and the
PAM child is left behind.
Due to the way OpenSSH performs internal accounting, these orphaned
PAM children are counted as pending connections by the master OpenSSH
server process. Once a certain number of orphans has accumulated, the
master decides that it is overloaded and stops accepting client
connections.
III. Impact
By repeatedly connecting to a vulnerable server, waiting for a
password prompt, and closing the connection, an attacker can cause
OpenSSH to stop accepting client connections until the system restarts
or an administrator manually kills the orphaned PAM processes.
IV. Workaround
The following command will show a list of orphaned PAM processes:
# pgrep -lf 'sshd.*\[pam\]'
The following command will kill orphaned PAM processes:
# pkill -f 'sshd.*\[pam\]'
To prevent OpenSSH from leaving orphaned PAM processes behind, perform
one of the following:
1) Disable PAM authentication in OpenSSH. Users will still be able to
log in using their Unix password, OPIE or SSH keys.
To do this, execute the following commands as root:
# echo 'UsePAM no' >>/etc/ssh/sshd_config
# /etc/rc.d/sshd restart
2) If disabling PAM is not an option - if, for instance, you use
RADIUS authentication, or store user passwords in an SQL database -
you may instead disable privilege separation. However, this may
leave OpenSSH vulnerable to hitherto unknown bugs, and should be
considered a last resort.
To do this, execute the following commands as root:
# echo 'UsePrivilegeSeparation no' >>/etc/ssh/sshd_config
# /etc/rc.d/sshd restart
V. Solution
Perform one of the following:
1) Upgrade your vulnerable system to 5-STABLE or to the RELENG_5_4 or
RELENG_5_3 security branch dated after the correction date.
2) To patch your present system:
The following patches have been verified to apply to FreeBSD 5.3 and
5.4 systems.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:09/openssh.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:09/openssh.patch.asc
b) Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
# cd /usr/src/secure/lib/libssh
# make obj && make depend && make && make install
# cd /usr/src/secure/usr.sbin/sshd
# make obj && make depend && make && make install
# /etc/rc.d/sshd restart
VI. Correction details
The following list contains the revision numbers of each file that was
corrected in FreeBSD.
Branch Revision
Path
- - -------------------------------------------------------------------------
RELENG_5
src/crypto/openssh/auth-pam.c 1.14.2.1
src/crypto/openssh/ssh_config 1.25.2.1
src/crypto/openssh/ssh_config.5 1.15.2.1
src/crypto/openssh/sshd_config 1.40.2.1
src/crypto/openssh/sshd_config.5 1.21.2.1
src/crypto/openssh/version.h 1.27.2.1
RELENG_5_4
src/UPDATING 1.342.2.24.2.21
src/sys/conf/newvers.sh 1.62.2.18.2.17
src/crypto/openssh/auth-pam.c 1.14.6.1
src/crypto/openssh/ssh_config 1.25.6.1
src/crypto/openssh/ssh_config.5 1.15.6.1
src/crypto/openssh/sshd_config 1.40.6.1
src/crypto/openssh/sshd_config.5 1.21.6.1
src/crypto/openssh/version.h 1.27.6.1
RELENG_5_3
src/UPDATING 1.342.2.13.2.30
src/sys/conf/newvers.sh 1.62.2.15.2.32
src/crypto/openssh/auth-pam.c 1.14.4.1
src/crypto/openssh/ssh_config 1.25.4.1
src/crypto/openssh/ssh_config.5 1.15.4.1
src/crypto/openssh/sshd_config 1.40.4.1
src/crypto/openssh/sshd_config.5 1.21.4.1
src/crypto/openssh/version.h 1.27.4.1
- - -------------------------------------------------------------------------
VII. References
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=248125
http://bugzilla.mindrot.org/show_bug.cgi?id=839
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0883
The latest revision of this advisory is available at
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:09.openssh.asc
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (FreeBSD)
iD8DBQFEBcVoFdaIBMps37IRAtciAJ0ZEisuqx4lAtn2vr+44e4mrWYQuQCeLLRB
kUuFQBE4Jy3SJeI+07wnknA=
=esdm
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBRAZZ0Ch9+71yA2DNAQIkxgP+KEGMpvL2UXEiT4uG6IYdoUYuDIUF6fd/
muL1PeO1U3OXGrDaCuTg7U2kN6zx8eU2iU7lNmukbNvOIXLBjIWI+azh9CzgDLHj
chBh4syziiyXwyLud5cotXyj0yt/qOntPJQyPK5bGJeiztiMrglxgHe4YFqU0z1U
DY0WEy6PAIU=
=1D+3
-----END PGP SIGNATURE-----