sigh, again


On Mon, Jun 24, 2002 at 03:00:10PM -0600, Theo de Raadt wrote:
> Date: Mon, 24 Jun 2002 15:00:10 -0600
> From: Theo de Raadt <deraadt@cvs.openbsd.org>
> Subject: Upcoming OpenSSH vulnerability
> To: bugtraq@securityfocus.com
> Cc: announce@openbsd.org
> Cc: dsi@iss.net
> Cc: misc@openbsd.org
>
> There is an upcoming OpenSSH vulnerability that we're working on with
> ISS. Details will be published early next week.
>
> However, I can say that when OpenSSH's sshd(8) is running with priv
> seperation, the bug cannot be exploited.
>
> OpenSSH 3.3p was released a few days ago, with various improvements
> but in particular, it significantly improves the Linux and Solaris
> support for priv sep. However, it is not yet perfect. Compression is
> disabled on some systems, and the many varieties of PAM are causing
> major headaches.
>
> However, everyone should update to OpenSSH 3.3 immediately, and enable
> priv seperation in their ssh daemons, by setting this in your
> /etc/ssh/sshd_config file:
>
> UsePrivilegeSeparation yes
>
> Depending on what your system is, privsep may break some ssh
> functionality. However, with privsep turned on, you are immune from
> at least one remote hole. Understand?
>
> 3.3 does not contain a fix for this upcoming bug.
>
> If priv seperation does not work on your operating system, you need to
> work with your vendor so that we get patches to make it work on your
> system. Our developers are swamped enough without trying to support
> the myriad of PAM and other issues which exist in various systems.
> You must call on your vendors to help us.
>
> Basically, OpenSSH sshd(8) is something like 27000 lines of code. A
> lot of that runs as root. But when UsePrivilegeSeparation is enabled,
> the daemon splits into two parts. A part containing about 2500 lines
> of code remains as root, and the rest of the code is shoved into a
> chroot-jail without any privs. This makes the daemon less vulnerable
> to attack.
>
> We've been trying to warn vendors about 3.3 and the need for privsep,
> but they really have not heeded our call for assistance. They have
> basically ignored us. Some, like Alan Cox, even went further stating
> that privsep was not being worked on because "Nobody provided any info
> which proves the problem, and many people dont trust you theo" and
> suggested I "might be feeding everyone a trojan" (I think I'll publish
> that letter -- it is just so funny). HP's representative was
> downright rude, but that is OK because Compaq is retiring him. Except
> for Solar Designer, I think none of them has helped the OpenSSH
> portable developers make privsep work better on their systems.
> Apparently Solar Designer is the only person who understands the need
> for this stuff.
>
> So, if vendors would JUMP and get it working better, and send us
> patches IMMEDIATELY, we can perhaps make a 3.3.1p release on Friday
> which supports these systems better. So send patches by Thursday
> night please. Then on Tuesday or Wednesday the complete bug report
> with patches (and exploits soon after I am sure) will hit BUGTRAQ.
>
> Let me repeat: even if the bug exists in a privsep'd sshd, it is not
> exploitable. Clearly we cannot yet publish what the bug is, or
> provide anyone with the real patch, but we can try to get maximum
> deployement of privsep, and therefore make it hurt less when the
> problem is published.
>
> So please push your vendor to get us maximally working privsep patches
> as soon as possible!
>
> We've given most vendors since Friday last week until Thursday to get
> privsep working well for you so that when the announcement comes out
> next week their customers are immunized. That is nearly a full week
> (but they have already wasted a weekend and a Monday). Really I think
> this is the best we can hope to do (this thing will eventually leak,
> at which point the details will be published).
>
> Customers can judge their vendors by how they respond to this issue.
>
> OpenBSD and NetBSD users should also update to OpenSSH 3.3 right away.
> On OpenBSD privsep works flawlessly, and I have reports that is also
> true on NetBSD. All other systems appear to have minor or major
> weaknesses when this code is running.
>
> (securityfocus postmaster; please post this through immediately, since
> i have bcc'd over 30 other places..)
_

What about if you have tcpwrappers setup
as in /etc/hosts.deny and allow
i wonder if you'd be safe / fine then too?

Oh god.. another one :D

Yes, yet another openssh vulnerability. I'm starting to wonder if the world needs a djb-ssh. ;)

Originally posted by cperciva
Yes, yet another openssh vulnerability. I'm starting to wonder if the world needs a djb-ssh. ;)

word

Originally posted by cperciva
Yes, yet another openssh vulnerability. I'm starting to wonder if the world needs a djb-ssh. ;)

I'm sure that would be great as long as you run only the djb-ssh server and the djb-ssh client :rolleyes:

djb-ssh
Where do I sign?

You know, its almost worth going to back telnet...

I haven't seen a telnetd exploit for a long time :D

<note>This was a joke :rolleyes: </note>

Hi!

I for one have decided to go back to the original SSH.COM sshd at least until a fully working version of OpenSSH 3.3 for Linux is released which is supposedly not vulnerable.

You can grab it (for free for Linux, *BSD) at ssh.com (http://commerce.ssh.com/sshsvr/index.html) but you will have to compile it yourself, no RPMs available.

-- kryps

I for one have decided to go back to the original SSH.COM sshd at least until a fully working version of OpenSSH 3.3 for Linux is released which is supposedly not vulnerable.

To ONE of the remote exploits. It's not totally invulnerable.
Read it carefully next time..

Originally posted by The Prohacker
You know, its almost worth going to back telnet...

I haven't seen a telnetd exploit for a long time :D

<note>This was a joke :rolleyes: </note>

I was about to say the same thing, except I'm not joking. At this rate, it'd be safer to use telnet.

I was about to say the same thing, except I'm not joking. At this rate, it'd be safer to use telnet.

Could always use SSLTelnet : )

Originally posted by cperciva
Yes, yet another openssh vulnerability. I'm starting to wonder if the world needs a djb-ssh. ;)

Actually you are dangerously close to the truth here Colin!

On April 27th 2002 or so there was a vulnerability in FreeBSD 4.4 and before in stdio.h and this is what DJB has to say about it in 1997 !
" I've mostly given up on the standard C library. Many of its facilities, particularly stdio, seem designed to encourage bugs. "

The man may sound rude and arrogant but there is no denying the fact he is a genius and in my 13 years of IT I have seen very few products better designed than qmail

But this is justa fool's opinion!

Cheers
Balaji

So much for secure by default! Looks like I'll have to toss OpenBSD down the drain! :stickout

Na, looks like they'll have a good fix for it Monday, so I'll hold my breath til then.

i wouldn't say djb is rude... more that he is very blunt.

he speaks his mind.. and you can argue with him about his opinions, but the fact is he is a wicked programmer who has made very very good programs that work and have no security issues since they have come out... and htey work very well with excellent performance :)

For those who care, this vulnerabiltiy does not effect FreeBSD unless you are running -CURRENT, which of course nobody is running that in a production environment (one hopes). The official release is available here:

http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=20584

tar.gz from good ol' GOBBLES attached.

(had to rename it .zip to make vbulletin happy)