Original release date: September 16, 2003<br> Last revised: Aug 12, 2008<br> Source: CERT/CC<br> <p>A complete revision history can be found at the end of this file.</p> <br> <a name="affected"></a> <h3>Systems Affected</h3> <ul> <li>Systems running versions of OpenSSH prior to 3.7.1</li> <li>Systems that use or derive code from vulnerable versions of OpenSSH</li> </ul> <br> <a name="overview"></a> <h2>Overview</h2> <p> There is a remotely exploitable vulnerability in a general buffer management function in versions of OpenSSH prior to 3.7.1. This may allow a remote attacker to corrupt heap memory which could cause a denial-of-service condition. It may also be possible for an attacker to execute arbitrary code. </p> <br> <a name="description"></a> <h2>I. Description</h2> <p> We are updating this advisory to inform users that Version 3.7.1 of OpenSSH has been released to patch a similar vulnerability in the buffer management code. <p>There are two errors in the buffer management code of OpenSSH. These vulnerabilities affect versions prior to 3.7.1. Version 3.7 is affected by one of these errors. The errors occur when a buffer is allocated for a large packet. When the buffer is cleared, an improperly sized chunk of memory is filled with zeros. This leads to heap corruption, which could cause a denial-of-service condition. These vulnerabilities may also allow an attacker to execute arbitrary code. </p> <p>The OpenSSH advisory has been updated to include a patch for version 3.7 as well as 3.6.1 and prior.</p> <blockquote> <a href="http://www.openssh.com/txt/buffer.adv"> http://www.openssh.com/txt/buffer.adv</a> </blockquote> <p> Other systems that use or derive code from OpenSSH may be affected. This includes network equipment and embedded systems. We have monitored incident reports that may be related to this vulnerability. </p> <p>Vulnerability Note <a href="http://www.kb.cert.org/vuls/id/333628">VU#333628</a> lists the vendors we contacted about these vulnerabilities. The vulnerability note is available from </p> <blockquote> <a href="http://www.kb.cert.org/vuls/id/333628"> http://www.kb.cert.org/vuls/id/333628</a> </blockquote> <p> This vulnerability has been assigned the following Common Vulnerabilities and Exposures (CVE) number: </p> <blockquote> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0693"> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0693</a> </blockquote> <br> <a name="impact"></a> <h2>II. Impact</h2> <p> While the full impact of this issues are unclear, the most likely result is heap corruption, which could lead to a denial of service. </p> <p> If it is possible for an attacker to execute arbitrary code, then they may be able to so with the privileges of the user running the sshd process, typically root. This impact may be limited on systems using the privilege separation (privsep) feature available in OpenSSH. </p> <br> <a name="solution"></a> <h2>III. Solution</h2> <h3>Upgrade to OpenSSH version 3.7.1</h3> <p>This vulnerability is resolved in OpenSSH version 3.7.1, which is available from the OpenSSH web site at</p> <blockquote> <a href="http://www.openssh.com/"> http://www.openssh.com/</a> </blockquote> <h3>Apply a patch from your vendor</h3> <p>A patches for these issues are included in the OpenSSH advisory at</p> <blockquote> <a href="http://www.openssh.com/txt/buffer.adv"> http://www.openssh.com/txt/buffer.adv</a> </blockquote> <p> This patch may be manually applied to correct this vulnerability in affected versions of OpenSSH. If your vendor has provided a patch or upgrade, you may want to apply it rather than using the patch from OpenSSH. Find information about vendor patches in <a href="#vendors">Appendix A</a>. We will update this document as vendors provide additional information.</p> <h3>Use privilege separation to minimize impact</h3> <p>System administrators running OpenSSH versions 3.2 or higher may be able to reduce the impact of this vulnerability by enabling the "UsePrivilegeSeparation" configuration option in their sshd configuration file. Typically, this is accomplished by creating a privsep user, setting up a restricted (chroot) environment, and adding the following line to /etc/ssh/sshd_config:</p> <font face="monospace"> <blockquote> <b>UsePrivilegeSeparation yes</b> </blockquote> </font> <p>This workaround does <b>not</b> prevent this vulnerability from being exploited, however due to the privilege separation mechanism, the intruder may be limited to a constrained chroot environment with restricted privileges. This workaround will not prevent this vulnerability from creating a denial-of-service condition. Not all operating system vendors have implemented the privilege separation code, and on some operating systems it may limit the functionality of OpenSSH. System administrators are encouraged to carefully review the implications of using the workaround in their environment and use a more comprehensive solution if one is available. The use of privilege separation to limit the impact of future vulnerabilities is encouraged.</p> <br> <a name="vendors"></a> <h2>Appendix A. - Vendor Information</h2> <p>This appendix contains information provided by vendors for this advisory. As vendors report new information to the CERT/CC, we will update this section and note the changes in the revision history. Additional vendors who have not provided direct statements, but who have made public statements or informed us of their status are listed in <a href="http://www.kb.cert.org/vuls/id/333628#systems">VU#333628</a>. If a vendor is not listed below or in <a href="http://www.kb.cert.org/vuls/id/333628#systems">VU#333628</a>, we have not received their comments.</p> <!-- end vendor --> <a name="appgate"></a> <h4>AppGate Network Security AB</h4> <blockquote> AppGate versions from 4.0 up to and including 5.3.1 does include the vulnerable code. Patches are available from the appgate support pages at <a href="http://www.appgate.com">http://www.appgate.com</a>. </blockquote> <!-- end vendor --> <a name="apple"></a> <h4>Apple Computers Inc.</h4> <blockquote> <p>Mac OS X 10.2.8 contains the patches to address CVE CAN-2003-0693, CAN-2003-0695, and CAN-2003-0682. On Mac OS X versions prior to 10.2.8, the vulnerability is limited to a denial of service from the possibility of causing sshd to crash. Each login session has its own sshd, so established connections are preserved up to the point where system resources are exhausted by an attack.</p> <p>To deliver the update in a rapid and reliable manner, only the patches for CVE IDs listed above were applied, and not the entire set of patches for OpenSSH 3.7.1. Thus, the OpenSSH version in Mac OS X 10.2.8, as obtained via the "ssh -V" command, is: <blockquote> OpenSSH_3.4p1+CAN-2003-0693, SSH protocols 1.5/2.0, OpenSSL 0x0090609f<br> </blockquote> <p>Mac OS X 10.2.8 is available as a free update for customers running Mac OS X 10.2.x. It is available from:<br> <blockquote> Mac OS X Client (updating from 10.2 - 10.2.5):<br> <a href="http://www.info.apple.com/kbnum/n120244">http://www.info.apple.com/kbnum/n120244</a><br> <br> Mac OS X Client (updating from 10.2.6 - 10.2.7):<br> <a href="http://www.info.apple.com/kbnum/n120245">http://www.info.apple.com/kbnum/n120245</a><br> <br> Mac OS X Server (updating from 10.2 - 10.2.5):<br> <a href="http://www.info.apple.com/kbnum/n120246">http://www.info.apple.com/kbnum/n120246</a><br> <br> Mac OS X Server (updating from 10.2.6 - 10.2.7):<br> <a href="http://www.info.apple.com/kbnum/n120247">http://www.info.apple.com/kbnum/n120247</a> </blockquote> </blockquote> <!-- end vendor --> <a name="bitvise"></a> <h4>Bitvise</h4> <blockquote> Our software shares no codebase with the OpenSSH implementation, therefore we believe that, in our products, this problem does not exist. </blockquote> <!-- end vendor --> <a name="cisco"></a> <h4>Cisco</h4> <blockquote> Cisco has some products which are vulnerable to this issue. Cisco's response is now published at <blockquote> <a href="http://www.cisco.com/warp/public/707/cisco-sa-20030917-openssh.shtml">http://www.cisco.com/warp/public/707/cisco-sa-20030917-openssh.shtml</a> </blockquote> </blockquote> <!-- end vendor --> <a name="cray"></a> <h4>Cray, Inc.</h4> <blockquote> Cray Inc. supports OpenSSH through its Cray Open Software (COS) package. Cray is vulnerable to this buffer management error and is in the process of compiling OpenSSH 3.7. The new version will be made available in the next COS release. </blockquote> <!-- end vendor --> <a name="debian"></a> <h4>Debian</h4> <blockquote> <p> Debian has issued DSA 382 and DSA 383 for these issues. <blockquote> <a href="http://www.debian.org/security/2003/dsa-382">http://www.debian.org/security/2003/dsa-382</a><br> <a href="http://www.debian.org/security/2003/dsa-383">http://www.debian.org/security/2003/dsa-383</a> </blockquote> </blockquote> <!-- end vendor --> <a name="f-secure"></a> <h4>F-Secure</h4> <blockquote> <p>This vulnerability does not affect any version of F-Secure SSH software that utilizes ssh protocol version 2. The non-affected versions have been available since 1998. </p> <p>This vulnerability only affects the following F-Secure SSH server versions: F-Secure SSH for Unix versions 1.3.14 and earlier. </p> <p>More information is available from</p> <blockquote> <a href="http://www.f-secure.com/support/technical/ssh/ssh1_openssh_buffer_management.shtml">http://www.f-secure.com/support/technical/ssh/ssh1_openssh_buffer_management.shtml</a> </blockquote> </blockquote> <!-- end vendor --> <a name="ibm"></a> <h4>IBM AIX</h4> <blockquote> <p>The AIX Security Team is aware of the issues discussed in CERT<br> Vulnerability Note VU#333628 and CERT Advisory CA-2003-24.<br> <br> OpenSSH is available for AIX via the AIX Toolbox for Linux or the<br> Bonus Pack.<br> <br> OpenSSH 3.4p1, revision 9 contains fixes for this issue for the AIX Toolbox<br> for Linux. For more information about the AIX Toolbox for Linux or to download<br> OpenSSH 3.4p1 revision 9, please see:<br> <br> <a href="http://www-1.ibm.com/servers/aix/products/aixos/linux/download.html">http://www-1.ibm.com/servers/aix/products/aixos/linux/download.html</a><br> <br> Please note that AIX Toolbox for Linux is available "as-is" and is unwarranted.<br> <br> Patched versions of OpenSSH for the Bonus Pack on AIX 5.1 and 5.2 are available<br> Please see:<br> <br> <a href="http://oss.software.ibm.com/developerworks/projects/opensshi">http://oss.software.ibm.com/developerworks/projects/opensshi</a> </blockquote> <!-- end vendor --> <a name="juniper"></a> <h4>Juniper Networks</h4> <blockquote> <p>Juniper Networks has identified this vulnerability in all shipping versions of JUNOS and coded a software fix. The fix will be included in all releases of JUNOS Internet software built on or after September 17. Customers with current support contracts should contact JTAC to obtain the fix for this vulnerability. <p> JUNOSe and SDX are not vulnerable to this issue. <p> Contract customers can review the details at: <blockquote> <a href="https://www.juniper.net/alerts/viewalert.jsp?txtAlertNumber=PSN-2003-09-007&actionBtn=Search">https://www.juniper.net/alerts/viewalert.jsp?txtAlertNumber=PSN-2003-09-007&actionBtn=Search</a> </blockquote> </blockquote> <!-- end vendor --> <a name="mandrakesoft"></a> <h4>Mandrake Software</h4> <blockquote> Mandrake Linux is affected and MDKSA-2003:090 will be released today with patched versions of OpenSSH to resolve this issue. </blockquote> <!-- end vendor --> <a name="mirapoint"></a> <h4>Mirapoint</h4> <blockquote> Mirapoint released a patch (D3_SSH_CA_2003_24) last night to fix the first reported vulnerability and will release D3_SSH_CA_2003_24_1 to cover the second. </blockquote> <!-- end vendor --> <a name="netbsd"></a> <h4>NetBSD</h4> <blockquote> The NetBSD Security Advisory on the OpenSSH buffer management issue is available here: <blockquote> <a href="ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-012.txt.asc">ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-012.txt.asc</a> </blockquote> </blockquote> <!-- end vendor --> <a name="netapp"></a> <h4>Network Appliance</h4> <blockquote> This issue applies only to SecureAdmin on Data ONTAP versions earlier than 6.4.3, and SecureAdmin for NetCache releases earlier than 5.5R2.<br> <br> All current releases (NetCache 5.6, 6.0 and 6.1, and Filer 6.5, 7.0, 7.1, 7.2, 7.3 and 10.0) have been secured against this issue.<br> <br> If you have an affected release: <blockquote> Disable the SSH server on the filer or NetCache appliance, or if it must remain enabled, ensure that the ssh.access option (config.admin.trusted_hosts in NetCache) is used to restrict ssh connections to authorized administrative hosts. </blockquote> </blockquote> <!-- end vendor --> <a name="openwall"></a> <h4>Openwall GNU/*/Linux</h4> <blockquote> The OpenSSH package in Openwall GNU/*/Linux did contain the buffer / memory management errors. As of 2003/09/17, we have included the fixes from OpenSSH 3.7.1 as well as 4 additional fixes to other such real or potential errors based on an exhaustive review of the OpenSSH source code for uses of *realloc() functions. At this time, it is uncertain whether and which of these bugs are exploitable. If exploits are possible, due to privilege separation, the worst direct impact should be limited to arbitrary code execution under the sshd pseudo-user account restricted within the chroot jail /var/empty, or under the logged in user account </blockquote> <!-- end vendor --> <a name="pragma"></a> <h4>Pragma Systems</h4> <blockquote> We have tested our code and double checked for the code vulnerability and we have found that our code is NOT vulnerable. </blockquote> <!-- end vendor --> <a name="putty"></a> <h4>PuTTY</h4> <blockquote> PuTTY is not based on the OpenSSH code base, so it should not be vulnerable to any OpenSSH-specific attacks. </blockquote> <!-- end vendor --> <a name="redhat"></a> <h4>Red Hat, Inc.</h4> <blockquote> Red Hat Linux and Red Hat Enterprise Linux ship with an OpenSSL package vulnerable to these issues. Updated OpenSSL packages are available along with our advisory at the URLs below. Users of the Red Hat Network can update their systems using the 'up2date' tool. </p> <p> Red Hat Linux: <blockquote> <a href="http://rhn.redhat.com/errata/RHSA-2003-279.html">http://rhn.redhat.com/errata/RHSA-2003-279.html</a> </blockquote> Red Hat Enterprise Linux: <blockquote> <a href="http://rhn.redhat.com/errata/RHSA-2003-280.html">http://rhn.redhat.com/errata/RHSA-2003-280.html</a> </blockquote> </blockquote> <!-- end vendor --> <a name="riverstone"></a> <h4>Riverstone Networks</h4> <blockquote> Riverstone Networks has issued an advisory on this issue at <a href="http://www.riverstonenet.com/support/tb0265-9.html">http://www.riverstonenet.com/support/tb0265-9.html</a>. </blockquote> <!-- end vendor --> <a name="secure_computing"></a> <h4>Secure Computing Corporation</h4> <blockquote> Sidewinder(r) and Sidewinder G2 Firewall(tm) (including all appliances) <blockquote> Not Vulnerable. <p>Sidewinder v5.x & Sidewinder G2 v6.x's embedded Type Enforcement(r) technology strictly limits the capabilities of Secure Computing's modified version of the OpenSSH daemon code integrated into the firewall's SecureOS operating system. Any attempt to exploit this vulnerability in the OpenSSH daemon code running on the firewalls results in an automatic termination of the attacker's connection and multiple Type Enforcement alarms. </blockquote> <p>Gauntlet(tm) & e-ppliance <blockquote> Not Vulnerable. <p>Gauntlet and e-ppliance do not include SSH server software, and are thus immune to this vulnerability.</p> </blockquote> </blockquote> <!-- end vendor --> <a name="ssh_communications"></a> <h4>SSH Communications Security</h4> <blockquote> SSH Secure Shell products do not contain the buffer management error. SSH Communications Security products have different code base than OpenSSH. </blockquote> <!-- end vendor --> <a name="sun"></a> <h4>Sun Microsystems</h4> <blockquote> The Solaris Secure Shell in Solaris 9 is impacted by this issue described in CERT Vulnerability Note VU#333628. Sun has published Sun Alert 56861 available here: <blockquote> <a href="http://sunsolve.sun.com/search/document.do?assetkey=1-26-56861-1">http://sunsolve.sun.com/search/document.do?assetkey=1-26-56861-1</a> </blockquote> which details the impact, contributing factors, workaround options, and resolution. This issue does not affect the Solaris Secure Shell in Solaris 10. </blockquote> <!-- end vendor --> <hr noshade> <p>The CERT/CC thanks Markus Friedl of the OpenSSH project for his technical assistance in producing this advisory.</p> <p></p> <hr noshade> <p>Authors: <a href="mailto:cert@cert.org?subject=CA-2003-24%20Feedback%20VU%23333628">Jason A. Rafail and Art Manion</a> <p></p> <!--#include virtual="/include/footer_nocopyright2.html" --> <p>Copyright 2003 Carnegie Mellon University.</p> <p>Revision History <pre> September 16, 2003: Initial release September 17, 2003: Updated with new information regarding 3.7.1 release September 17, 2003: Added SSH Communications Security vendor statement September 17, 2003: Added Red Hat, Inc. vendor statement September 17, 2003: Added Sun Microsystems vendor statement September 17, 2003: Added NetBSD vendor statement September 17, 2003: Added Network Appliance vendor statement September 18, 2003: Added Cisco vendor statement September 18, 2003: Updated Red Hat, Inc. links in vendor statement September 18, 2003: Added IBM vendor statement September 18, 2003: Added F-Secure vendor statement September 18, 2003: Added OpenWall GNU/*/Linux vendor statement September 22, 2003: Added Juniper Networks vendor statement September 22, 2003: Added Mirapoint vendor statement September 23, 2003: Added Secure Computing Corp. vendor statement September 23, 2003: Added AppGate Network Security AB vendor statement October 01, 2003: Added Apple Computers vendor statement October 01, 2003: Added Pragma Systems vendor statement October 01, 2003: Updated IBM vendor statement October 01, 2003: Added Riverstone vendor statement January 16, 2007: Updated Sun vendor statement August 12, 2008: Updated Network Appliance vendor statement </pre> </p> |