NetBSD Security Advisory 2008-005: OpenSSH Multiple issues

Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]

From: NetBSD Security-Officer <security-officer@...>

To: <netbsd-announce@...>

Subject: NetBSD Security Advisory 2008-005: OpenSSH Multiple issues

Date: Monday, April 21, 2008 - 6:27 pm

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1
		 NetBSD Security Advisory 2008-005

		 =================================
Topic:		OpenSSH Multiple issues
Version:	NetBSD-current:		affected

		NetBSD 4.0:		affected

		NetBSD 3.1.*:		affected

		NetBSD 3.1:		affected

		NetBSD 3.0:		affected

		NetBSD 3.0.*:		affected
Severity:	ForceCommand bypass and X11 session hijacking
Fixed:		NetBSD-current:		April 05, 2008

		NetBSD-4 branch:	April 07, 2008

			(4.1 will include the fix)

		NetBSD-4-0 branch:	April 07, 2008

			(4.0.1 will include the fix)

		NetBSD-3-1 branch:	April 08, 2008

			(3.1.2 will include the fix)

		NetBSD-3-0 branch:	April 08, 2008

			(3.0.4 will include the fix)

		NetBSD-3 branch:	April 08, 2008

			(3.2 will include the fix)

		pkgsrc:			openssh-4.7.1nb3 corrects the issue
Abstract

========
Two issues have been found with the version of OpenSSH that ships

with NetBSD 3.x, NetBSD 4.x and NetBSD-current.  The two known security

issues include X11 session hijacking and a bypass of the ForceCommand

directive.
These vulnerabilities have been assigned CVE-2008-1483 for the X11 session

hijacking and CVE-2008-1657 for the ForceCommand bypass.
Technical Details

=================
The ForceCommand sshd_config(5) directive can be bypassed by authenticated

users by utilising the processing of the ~/.ssh/rc file.  The ForceCommand

directive was introduced in OpenSSH 4.4 as such only NetBSD-current and

NetBSD-4 are impacted by this issue.
OpenSSH 4.9 introduced a no-user-rc option to the AuthorizedKeys file

for blocking the processing of user ~/.ssh/rc files.  This has been

introduced in all NetBSD branches and documented in the sshd(8) man page.
The second issue allows local users to hijack forwarded X11 sessions of

other users. 
Solutions and Workarounds

=========================
It is recommended that NetBSD users of vulnerable versions update

their binaries.
The following instructions describe how to upgrade your OpenSSH

binaries by updating your source tree and rebuilding and

installing a new version of OpenSSH.
* NetBSD-current:
	Systems running NetBSD-current dated from before 2008-04-05

	should be upgraded to NetBSD-current dated 2008-04-06 or later.
	The following files/directories need to be updated from the

	netbsd-current CVS branch (aka HEAD):

		crypto/dist/ssh/channels.c

		crypto/dist/ssh/auth-options.c

		crypto/dist/ssh/auth-options.h

		crypto/dist/ssh/session.c

		crypto/dist/ssh/sshd.8

		crypto/dist/ssh/sshd_config.5
	To update from CVS, re-build, and re-install ssh:
		# cd src

		# cvs update \

			crypto/dist/ssh/channels.c \

			crypto/dist/ssh/auth-options.c \

			crypto/dist/ssh/auth-options.h \

			crypto/dist/ssh/session.c \

			crypto/dist/ssh/sshd.8 \

			crypto/dist/ssh/sshd_config.5

		# cd ../../usr.bin/ssh

		# make USETOOLS=no cleandir dependall

		# make USETOOLS=no install
* NetBSD 4.*:
	Systems running NetBSD 4.* sources dated from before

	2008-04-07 should be upgraded from NetBSD 4.* sources dated

	2008-04-08 or later.
	The following files/directories need to be updated from the

	netbsd-4 or netbsd-4-0 branches:

		crypto/dist/ssh/channels.c

		crypto/dist/ssh/auth-options.c

		crypto/dist/ssh/auth-options.h

		crypto/dist/ssh/session.c

		crypto/dist/ssh/sshd.8

		crypto/dist/ssh/sshd_config.5
	To update from CVS, re-build, and re-install ssh:
		# cd src

		# cvs update -r  \

			crypto/dist/ssh/channels.c \

			crypto/dist/ssh/auth-options.c \

			crypto/dist/ssh/auth-options.h \

			crypto/dist/ssh/session.c \

			crypto/dist/ssh/sshd.8 \

			crypto/dist/ssh/sshd_config.5

		# cd ../../usr.bin/ssh

		# make USETOOLS=no cleandir dependall

		# make USETOOLS=no install
* NetBSD 3.*:
	Systems running NetBSD 3.* sources dated from before

	2008-04-08 should be upgraded from NetBSD 3.* sources dated

	2008-04-09 or later.
	The following files/directories need to be updated from the

	netbsd-3, netbsd-3-0 or netbsd-3-1 branches:

		crypto/dist/ssh/channels.c

		crypto/dist/ssh/auth-options.c

		crypto/dist/ssh/auth-options.h

		crypto/dist/ssh/session.c

		crypto/dist/ssh/sshd.8

		crypto/dist/ssh/sshd_config.5
	To update from CVS, re-build, and re-install ssh:
		# cd src

		# cvs update -r  \

			crypto/dist/ssh/channels.c \

			crypto/dist/ssh/auth-options.c \

			crypto/dist/ssh/auth-options.h \

			crypto/dist/ssh/session.c \

			crypto/dist/ssh/sshd.8 \

			crypto/dist/ssh/sshd_config.5

		# cd ../../usr.bin/ssh

		# make USETOOLS=no cleandir dependall

		# make USETOOLS=no install
Revision History

================
	2008-04-21	Initial release
More Information

================
Advisories may be updated as new information becomes available.

The most recent version of this advisory (PGP signed) can be found at

  ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2008-005.tx...
Information about NetBSD and NetBSD security can be found at

http://www.NetBSD.org/ and http://www.NetBSD.org/Security/.
Copyright 2008, The NetBSD Foundation, Inc.  All Rights Reserved.

Redistribution permitted only in full, unmodified form.
$NetBSD: NetBSD-SA2008-005.txt,v 1.1 2008/04/15 20:19:56 adrianp Exp $
-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.9 (NetBSD)
iQCVAwUBSAUSKz5Ru2/4N2IFAQLwfAP/ZUvcjBqGo9CN1SzfBYKALUgzWDB0bKd3

oorJvVslKhVZv+3FOBbY3kHAsSFVTiGJFXq3cX6HY0HXt7F7JVsuPv8hQ69WhMP4

bobZpnoTH2wgLN+I/Y8maYd4C3gb1iAQ4ET/26p9wWqpMAwfwB99vOTgZCRbGS7S

lC/HmXQnnKg=

=M5om

-----END PGP SIGNATURE-----
>From security-officer@netbsd.org Mon Apr 21 23:14:17 2008

From: NetBSD Security-Officer

To: netbsd-announce@NetBSD.org

Subject: NetBSD Security Advisory 2008-005: OpenSSH Multiple issues

Organisation: The NetBSD Foundation, Inc.

Reply-To: NetBSD Security Officer

Mime-Version: 1.0

Content-Type: text/plain; charset=us-ascii

Content-Disposition: inline

Status: RO
-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1
		 NetBSD Security Advisory 2008-005

		 =================================
Topic:		OpenSSH Multiple issues
Version:	NetBSD-current:		affected

		NetBSD 4.0:		affected

		NetBSD 3.1.*:		affected

		NetBSD 3.1:		affected

		NetBSD 3.0:		affected

		NetBSD 3.0.*:		affected
Severity:	ForceCommand bypass and X11 session hijacking
Fixed:		NetBSD-current:		April 05, 2008

		NetBSD-4 branch:	April 07, 2008

			(4.1 will include the fix)

		NetBSD-4-0 branch:	April 07, 2008

			(4.0.1 will include the fix)

		NetBSD-3-1 branch:	April 08, 2008

			(3.1.2 will include the fix)

		NetBSD-3-0 branch:	April 08, 2008

			(3.0.4 will include the fix)

		NetBSD-3 branch:	April 08, 2008

			(3.2 will include the fix)

		pkgsrc:			openssh-4.7.1nb3 corrects the issue
Abstract

========
Two issues have been found with the version of OpenSSH that ships

with NetBSD 3.x, NetBSD 4.x and NetBSD-current.  The two known security

issues include X11 session hijacking and a bypass of the ForceCommand

directive.
These vulnerabilities have been assigned CVE-2008-1483 for the X11 session

hijacking and CVE-2008-1657 for the ForceCommand bypass.
Technical Details

=================
The ForceCommand sshd_config(5) directive can be bypassed by authenticated

users by utilising the processing of the ~/.ssh/rc file.  The ForceCommand

directive was introduced in OpenSSH 4.4 as such only NetBSD-current and

NetBSD-4 are impacted by this issue.
OpenSSH 4.9 introduced a no-user-rc option to the AuthorizedKeys file

for blocking the processing of user ~/.ssh/rc files.  This has been

introduced in all NetBSD branches and documented in the sshd(8) man page.
The second issue allows local users to hijack forwarded X11 sessions of

other users. 
Solutions and Workarounds

=========================
There are two possible workarounds currently known for the X11 session

hijacking issue (CVE-2008-1483).  Administrators can choose to set either of

the two following options in sshd_config(5):
	X11Forwarding no

	AddressFamily inet
It is recommended that NetBSD users of vulnerable versions update

their binaries.
The following instructions describe how to upgrade your OpenSSH

binaries by updating your source tree and rebuilding and

installing a new version of OpenSSH.
* NetBSD-current:
	Systems running NetBSD-current dated from before 2008-04-05

	should be upgraded to NetBSD-current dated 2008-04-06 or later.
	The following files/directories need to be updated from the

	netbsd-current CVS branch (aka HEAD):

		crypto/dist/ssh/channels.c

		crypto/dist/ssh/auth-options.c

		crypto/dist/ssh/auth-options.h

		crypto/dist/ssh/session.c

		crypto/dist/ssh/sshd.8

		crypto/dist/ssh/sshd_config.5
	To update from CVS, re-build, and re-install ssh:
		# cd src

		# cvs update \

			crypto/dist/ssh/channels.c \

			crypto/dist/ssh/auth-options.c \

			crypto/dist/ssh/auth-options.h \

			crypto/dist/ssh/session.c \

			crypto/dist/ssh/sshd.8 \

			crypto/dist/ssh/sshd_config.5

		# cd ../../usr.bin/ssh

		# make USETOOLS=no cleandir dependall

		# make USETOOLS=no install
* NetBSD 4.*:
	Systems running NetBSD 4.* sources dated from before

	2008-04-07 should be upgraded from NetBSD 4.* sources dated

	2008-04-08 or later.
	The following files/directories need to be updated from the

	netbsd-4 or netbsd-4-0 branches:

		crypto/dist/ssh/channels.c

		crypto/dist/ssh/auth-options.c

		crypto/dist/ssh/auth-options.h

		crypto/dist/ssh/session.c

		crypto/dist/ssh/sshd.8

		crypto/dist/ssh/sshd_config.5
	To update from CVS, re-build, and re-install ssh:
		# cd src

		# cvs update -r  \

			crypto/dist/ssh/channels.c \

			crypto/dist/ssh/auth-options.c \

			crypto/dist/ssh/auth-options.h \

			crypto/dist/ssh/session.c \

			crypto/dist/ssh/sshd.8 \

			crypto/dist/ssh/sshd_config.5

		# cd ../../usr.bin/ssh

		# make USETOOLS=no cleandir dependall

		# make USETOOLS=no install
* NetBSD 3.*:
	Systems running NetBSD 3.* sources dated from before

	2008-04-08 should be upgraded from NetBSD 3.* sources dated

	2008-04-09 or later.
	The following files/directories need to be updated from the

	netbsd-3, netbsd-3-0 or netbsd-3-1 branches:

		crypto/dist/ssh/channels.c

		crypto/dist/ssh/auth-options.c

		crypto/dist/ssh/auth-options.h

		crypto/dist/ssh/session.c

		crypto/dist/ssh/sshd.8

		crypto/dist/ssh/sshd_config.5
	To update from CVS, re-build, and re-install ssh:
		# cd src

		# cvs update -r  \

			crypto/dist/ssh/channels.c \

			crypto/dist/ssh/auth-options.c \

			crypto/dist/ssh/auth-options.h \

			crypto/dist/ssh/session.c \

			crypto/dist/ssh/sshd.8 \

			crypto/dist/ssh/sshd_config.5

		# cd ../../usr.bin/ssh

		# make USETOOLS=no cleandir dependall

		# make USETOOLS=no install
Revision History

================
	2008-04-21	Initial release
More Information

================
Advisories may be updated as new information becomes available.

The most recent version of this advisory (PGP signed) can be found at

  ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2008-005.tx...
Information about NetBSD and NetBSD security can be found at

http://www.NetBSD.org/ and http://www.NetBSD.org/Security/.
Copyright 2008, The NetBSD Foundation, Inc.  All Rights Reserved.

Redistribution permitted only in full, unmodified form.
$NetBSD: NetBSD-SA2008-005.txt,v 1.2 2008/04/21 19:06:14 adrianp Exp $
-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.9 (NetBSD)
iQCVAwUBSAzmED5Ru2/4N2IFAQJgNAQApCTYCDFJ+ahtw5xyqeiHVQw0k0ycJ4Om

SwEfynUVGR1EMM3dPoFQRyaaLKinDtC5IKaHKx27cWd/xFQdRSF8sfTPKgenjiZx

5UdCjge6k3eAB1wPKO4+H8LLAggBzX38RPetzauvt/+sECfyg+rmTwFZxogGlxbs

pNBBZLxyxgI=

=u/fg

-----END PGP SIGNATURE-----

Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]

Messages in current thread:

Mailing list for NetBSD/x86_64 created, Frank van der Linden, (Thu Feb 27, 8:07 am)

Announcing NetBSD 5.0.1, Soren Jacobsen, (Sun Aug 2, 4:48 pm)

NetBSD Security Advisory 2003-010: remote panic in OSI netwo..., NetBSD Security Officer, (Mon Aug 4, 2:13 pm)

10 years of pkgsrc - the interviews, Mark Weinem, (Wed Oct 17, 10:26 am)

NetBSD Security Advisory 2009-001: PF firewall remote Denial..., NetBSD Security Officer, (Tue Jun 23, 4:50 pm)

NetBSD Security Advisory 2004-002: Inconsistent IPv6 path MT..., NetBSD Security-Officer, (Thu Feb 19, 9:36 am)

anoncvs server is back on line, Christos Zoulas, (Fri Jan 14, 4:19 pm)

The pkgsrc-2005Q3 Branch, Alistair Crooks, (Mon Sep 26, 5:44 pm)

NetBSD Security Advisory 2005-005: cgd(4) key destruction on..., NetBSD Security-Officer, (Mon Nov 7, 6:56 pm)

NetBSD Security Advisory 2008-005: OpenSSH Multiple issues, NetBSD Security-Officer, (Mon Apr 21, 6:27 pm)

End of life for the NetBSD 1.6 branch, Matthias Scheler, (Tue May 16, 12:58 pm)

Donations for server upgrades, Michael Graff, (Fri Jul 26, 6:56 pm)

NetBSD Security Advisory 2006-021: Integer overflows in CID-..., NetBSD Security-Officer, (Thu Sep 21, 6:13 pm)

NetBSD Security Advisory 2008-013: IPv6 Neighbor Discovery P..., NetBSD Security-Officer, (Mon Oct 27, 6:44 pm)


linux-kernel:
Thomas Gleixner	Re: Linux 2.6.21-rc1
Tarkan Erimer	Re: Dual-Licensing Linux Kernel with GPL V2 and GPL V3
James Bottomley	[Ksummit-2008-discuss] Fixing the Kernel Janitors project
James Morris	Re: LSM conversion to static interface
git:

linux-netdev:
Natalie Protasevich	[BUG] New Kernel Bugs
Christoph Hellwig	Re: [PATCH 06/32] IGET: Mark iget() and read_inode() as being obsolete [try #2]
Linus Torvalds	Re: [GIT]: Networking
Jarek Poplawski	[PATCH take 2] pkt_sched: Protect gen estimators under est_lock.
openbsd-misc:

NetBSD Security Advisory 2008-005: OpenSSH Multiple issues

Online users