Another OpenSSH-portable vulnerability?

written by jedi on July 9th, 2008 @ 09:42 AM

Yet another vulnerability in the PAM code of OpenSSH-portable. A basic format-string bug. Of course if you are running FreeBSD, the base OpenSSH is as affected as the port. Of course, almost every Linux distro is affected. And of course the latest release (5.0) is affected.

Simple fix:

Edit auth1.c and replace

        packet_disconnect(msg);

with

        packet_disconnect("%s", msg);

OpenBSD is not affected, this is only in OpenSSH-portable.

Published today by Mrdkaaa for the pwnie awards.

Update: it doesn't seem exploitable in the real world, though, see That thread, pointed out by Greg (thanks!)

posted in:

OpenBSD, Security

tags:

,

comments are closed

3 comments

Comments

  • Timo on 09 Jul 18:44

    I’ve been reading your blog through RSS, and noticed that the links point to http://127.0.0.1:3000/ instead of http://00f.net/

  • Denis on 09 Jul 20:22

    Same comment as Timo :)

    Plus, I think you have a typo in your post : s/OpenBSD/OpenSSH/ ;)

  • Greg on 10 Jul 11:50

    Thanx to bringing this bug to our attention :).

    I guess he would say OpenBSD’s OpenSSH (not the same source code as OpenSSH-Portable).

    In complement, see the thread on openssh-unix-dev: loginmsg bug . This bug doesn’t seem exploitable (or if someone – with no local account and write permissions on PAM files – find a way to control loginmsg :) ).

Comments are closed

Options:

Size

Colors