TUCoPS :: BSD :: ciack058.htm

OpenSSH UseLogin Vulnerability
OpenSSH UseLogin Vulnerability Privacy and Legal Notice


K-058: OpenSSH UseLogin Vulnerability

July 6, 2000 17:00 GMT
PROBLEM:       If the UseLogin option is enabled, then the remote user's
               commands will be executed with an incorrect user id.
PLATFORM:      All platforms running FreeBSD 4.0-RELEASE, FreeBSD 4.0-STABLE,
               and FreeBSD 5.0-CURRENT prior to the correction date.
DAMAGE:        This vulnerability allows remote users to run commands with
               elevated (usually root) privileges.
SOLUTION:      Upgrade or apply the patch.

VULNERABILITY The risk is HIGH if the UseLogin option is enabled. The ASSESSMENT: vulnerability has been discussed in public forums.
[ Start FreeBSD Advisory ] ============================================================================= FreeBSD-SA-00:30 Security Advisory FreeBSD, Inc. Topic: OpenSSH UseLogin directive permits remote root access Category: core Module: openssh Announced: 2000-07-05 Credits: Markus Friedl <markus@OpenBSD.org> Affects: FreeBSD 4.0-RELEASE, FreeBSD 4.0-STABLE and 5.0-CURRENT prior to the correction date Corrected: 2000-06-11 Vendor status: Disclosed vulnerability. FreeBSD only: NO I. Background OpenSSH is an implementation of the SSH1 (and SSH2 in later versions) secure shell protocols for providing encrypted and authenticated network access, which is available free for unrestricted use. II. Problem Description The sshd server is typically invoked as root so it can manage general user logins. OpenSSH has a configuration option, not enabled by default ("UseLogin") which specifies that user logins should be done via the /usr/bin/login command instead of handled internally. OpenSSH also has a facility to enable remote users to execute commands on the server non-interactively. In this case, the UseLogin directive fails to correctly drop root privileges before executing the command, meaning that remote users without root access can execute commands on the local system as root. Note that with the default configuration, OpenSSH is not vulnerable to this problem, and this option is not needed for the vast majority of systems. OpenSSH is installed if you chose to install the 'crypto' distribution at install-time or when compiling from source, and you either have the international RSA libraries or installed the RSAREF port. III. Impact If your sshd configuration was modified to enable the 'UseLogin' directive then remote users with SSH access to the local machine can execute arbitrary commands as root. IV. Workaround Set 'UseLogin No' in your /etc/ssh/sshd_config file and restart the SSH server by issuing the following command as root: # kill -HUP `cat /var/run/sshd.pid` This will cause the parent process to respawn and reread its configuration file, and should not interfere with existing SSH sessions. Note that a bug in sshd (discovered during preparation of this advisory, fixed in FreeBSD 5.0-CURRENT and 4.0-STABLE as of 2000-07-03) means that it will fail to restart correctly unless it was originally invoked with an absolute path (i.e. "/usr/sbin/sshd" instead of "sshd"). Therefore you should verify that the server is still running after you deliver the HUP signal: # ps -p `cat /var/run/sshd.pid` PID TT STAT TIME COMMAND 2110 ?? Ss 0:00.97 /usr/sbin/sshd If the server is no longer running, restart it by issuing the following command as root: # /usr/sbin/sshd V. Solution One of the following: 1) Upgrade to FreeBSD 4.0-STABLE or 5.0-CURRENT after the correction date. Note that these versions of FreeBSD contain a newer version of OpenSSH than was in 4.0-RELEASE, version 2.1, which provides enhanced functionality including support for the SSH2 protocol and DSA keys. 2) Save this advisory as a file and extract the relevant patch for your version of FreeBSD, or download the relevant patch and detached PGP signature from the following location: # fetch ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-00:30/sshd.patch # fetch ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-00:30/sshd.patch.asc Verify the detached signature using your PGP utility. Issue the following commands as root: # cd /usr/src/crypto/openssh # patch -p < /path/to/patch/or/advisory # cd /usr/src/secure/lib/libssh # make all # cd /usr/src/secure/usr.sbin/sshd # make all install # kill -HUP `cat /var/run/sshd.pid` See the note in the "Workarounds" section about verifying that the sshd server is still running. VI. Patch Index: sshd.c =================================================================== RCS file: /home/ncvs/src/crypto/openssh/sshd.c,v retrieving revision 1.6 diff -u -r1.6 sshd.c --- sshd.c 2000/03/09 14:52:31 1.6 +++ sshd.c 2000/07/04 03:40:46 @@ -2564,7 +2564,13 @@ char *argv[10]; #ifdef LOGIN_CAP login_cap_t *lc; +#endif + /* login(1) is only called if we execute the login shell */ + if (options.use_login && command != NULL) + options.use_login = 0; + +#ifdef LOGIN_CAP lc = login_getpwclass(pw); if (lc == NULL) lc = login_getclassbyname(NULL, pw); [ End FreeBSD Advisory ]

CIAC wishes to acknowledge the contributions of FreeBSD for the information contained in this bulletin.

CIAC services are available to DOE, DOE Contractors, and the NIH. CIAC can be contacted at:
    Voice:          +1 925-422-8193 (7 x 24)
    FAX:            +1 925-423-8002
    STU-III:        +1 925-423-2604
    E-mail:          ciac@llnl.gov
    World Wide Web:  http://www.ciac.org/
                     (same machine -- either one will work)
    Anonymous FTP:   ftp.ciac.org
                     (same machine -- either one will work)

This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes.
[Privacy and Legal Notice]

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH