__________________________________________________________

                       The U.S. Department of Energy
                   Computer Incident Advisory Capability
                           ___  __ __    _     ___
                          /       |     /_\   /
                          \___  __|__  /   \  \___
             __________________________________________________________

                             INFORMATION BULLETIN

               CERT: OpenSSH PAM challenge authentication failure
                         [Vulnerability Note VU#602204]

September 30, 2003 18:00 GMT                                      Number N-157
______________________________________________________________________________
PROBLEM:       A vulnerability in the challenge authentication code of the 
               Portable OpenSSH server when using the SSHv1 protocol and 
               Pluggable Authentication Modules (PAM), could permit a remote 
               attacker to log in to the system as any user, including 
               potentially root, without using a password. 
PLATFORM:      OpenSSH 3.7.1p1 (portable) 
DAMAGE:        A remote attacker could potentially log in to the system as any 
               user, including root, using a null password. 
SOLUTION:      Change the config file or apply upgrades. 
               (Note--changing the config file fixes the CIAC N-158 CERT 
               Portable OpenSSH server PAM conversion stack corruption.) 
______________________________________________________________________________
VULNERABILITY  The risk is HIGH. It is possible for an attacker to log in to 
ASSESSMENT:    the system as any user, including potentially root, without 
               using a password. 
______________________________________________________________________________
LINKS: 
 CIAC BULLETIN:      http://www.ciac.org/ciac/bulletins/n-157.shtml 
 ORIGINAL BULLETIN:  http://www.kb.cert.org/vuls/id/602204 
______________________________________________________________________________
[***** Start Vulnerability Note VU#602204 *****]

Vulnerability Note VU#602204

OpenSSH PAM challenge authentication failure

Overview
There is a vulnerability in the challenge authentication code of the Portable 
OpenSSH server when using the SSHv1 protocol and Pluggable Authentication Modules 
(PAM). This vulnerability could permit a remote attacker to log in to the system 
as any user, including potentially root, without using a password. 

I. Description
There is a vulnerability in the challenge authentication code of the Portable 
OpenSSH server when using the SSHv1 protocol and Pluggable Authentication Modules 
(PAM). Versions 3.7p1 and 3.7.1p1 are affected. Note that the OpenBSD-specific 
releases are not affected by this issue. 

Remote attackers could exploit servers configured with the following parameters: 

OpenSSH 3.7.1p1 (portable)
Any platform
compiled with --with-pam
PrivilegeSeparation disabled
Protocol version 1 enabled (default)
ChallengeResponse enabled (default)

Note that this affects systems with password authentication disabled but challenge-
response authentication still enabled. This does not to affect systems using SSHv2, 
but many systems are configured to fall back to SSHv1 if SSHv2 is not supported by 
the client. 

II. Impact
A remote attacker could potentially log in to the system as any user, including 
root, using a null password. The root user can only be logged into if 
"PermitRootLogin" is enabled. 

III. Solution
OpenSSH has announced version 3.7.1p2 to resolve this issue. 
This issue can be mitigated by not using PAM. Set "UsePAM no" in sshd_config. To 
prevent root logins, Set "PermitRootLogin no". 

Systems Affected
Vendor Status Date Updated 
AppGate Network Security AB Not Vulnerable 23-Sep-2003 
Apple Computer Inc. Not Vulnerable 23-Sep-2003 
Bitvise Not Vulnerable 23-Sep-2003 
Check Point Not Vulnerable 24-Sep-2003 
Cisco Systems Inc. Unknown 23-Sep-2003 
Clavister Not Vulnerable 24-Sep-2003 
Cray Inc. Not Vulnerable 23-Sep-2003 
Debian Not Vulnerable 23-Sep-2003 
Gentoo Linux Vulnerable 24-Sep-2003 
IBM eServer Unknown 23-Sep-2003 
Ingrian Networks Not Vulnerable 23-Sep-2003 
MandrakeSoft Not Vulnerable 23-Sep-2003 
Microsoft Corporation Not Vulnerable 23-Sep-2003 
Mirapoint Not Vulnerable 23-Sep-2003 
NetScreen Not Vulnerable 23-Sep-2003 
Network Appliance Not Vulnerable 23-Sep-2003 
OpenSSH Vulnerable 23-Sep-2003 
Openwall GNU/*/Linux Not Vulnerable 24-Sep-2003 
Pragma Systems Not Vulnerable 23-Sep-2003 
Red Hat Inc. Not Vulnerable 23-Sep-2003 
Sun Microsystems Inc. Not Vulnerable 24-Sep-2003 
SuSE Inc. Not Vulnerable 23-Sep-2003 
WatchGuard Not Vulnerable 24-Sep-2003 

References


http://marc.theaimsgroup.com/?l=openbsd-misc&m=106432248311634&w=2
http://www.openssh.com/txt/sshpam.adv 
Credit
Thanks to Petri Heinonen and the OUSPG Team for reporting this vulnerability. 

This document was written by Jason A Rafail. 

Other Information
Date Public 09/23/2003 
Date First Published 09/23/2003 07:43:50 PM 
Date Last Updated 09/24/2003 
CERT Advisory   
CVE Name CAN-2003-0786 
Metric 6.58 
Document Revision 23 


[***** End Vulnerability Note VU#602204 *****]
_______________________________________________________________________________

CIAC wishes to acknowledge the contributions of CERT Coordination Center for the 
information contained in this bulletin.
_______________________________________________________________________________


CIAC, the Computer Incident Advisory Capability, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.

CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
    Voice:    +1 925-422-8193 (7x24)
    FAX:      +1 925-423-8002
    STU-III:  +1 925-423-2604
    E-mail:   ciac@ciac.org

Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.

   World Wide Web:      http://www.ciac.org/
   Anonymous FTP:       ftp.ciac.org

PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins.  If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.

This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.

LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)

N-147: Hewlett Packard Potential Security Vulnerability B.11.11 DCE
N-148: Sun Security Issue Involving the Solaris sadmind(1M) Daemon
N-149: Sendmail 8.12.9 Prescan Bug
N-150: Red Hat Updated KDE packages fix security issues
N-151: OpenSSH Buffer Management Error
N-152: Real Networks Streaming Server Vulnerability
N-153: New Worms and Helpful Computer Users
N-154: IBM DB2 Buffer Overflow Vulnerabilities
N-155: Red Hat Updated Perl packages fix security issues
N-156: ProFTPD ASCII File Remote Compromise Vulnerability