SSH client xauth Vulnerability
BID:1006
Info
SSH client xauth Vulnerability
| Bugtraq ID: | 1006 |
| Class: | Configuration Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Feb 24 2000 12:00AM |
| Updated: | Feb 24 2000 12:00AM |
| Credit: | This vulnerability was posted to the Bugtraq mailing list by Brian Caswell <[email protected]> on February 24, 2000. |
| Vulnerable: |
SSH Communications Security SSH2 2.0.12 SSH Communications Security SSH2 2.0.11 SSH Communications Security SSH2 2.0.10 SSH Communications Security SSH2 2.0.9 SSH Communications Security SSH2 2.0.8 SSH Communications Security SSH2 2.0.7 SSH Communications Security SSH2 2.0.6 SSH Communications Security SSH2 2.0.5 SSH Communications Security SSH2 2.0.4 SSH Communications Security SSH2 2.0.3 SSH Communications Security SSH2 2.0.2 SSH Communications Security SSH2 2.0.1 SSH Communications Security SSH2 2.0 SSH Communications Security SSH 1.2.27 SSH Communications Security SSH 1.2.26 SSH Communications Security SSH 1.2.25 SSH Communications Security SSH 1.2.24 SSH Communications Security SSH 1.2.23 SSH Communications Security SSH 1.2.22 SSH Communications Security SSH 1.2.21 SSH Communications Security SSH 1.2.20 SSH Communications Security SSH 1.2.19 SSH Communications Security SSH 1.2.18 SSH Communications Security SSH 1.2.17 SSH Communications Security SSH 1.2.16 SSH Communications Security SSH 1.2.15 SSH Communications Security SSH 1.2.14 SSH Communications Security SSH 1.2.13 SSH Communications Security SSH 1.2.12 SSH Communications Security SSH 1.2.11 SSH Communications Security SSH 1.2.10 SSH Communications Security SSH 1.2.9 SSH Communications Security SSH 1.2.8 SSH Communications Security SSH 1.2.7 SSH Communications Security SSH 1.2.6 SSH Communications Security SSH 1.2.5 SSH Communications Security SSH 1.2.4 SSH Communications Security SSH 1.2.3 SSH Communications Security SSH 1.2.2 SSH Communications Security SSH 1.2.1 OpenBSD OpenSSH 1.2 |
| Not Vulnerable: |
OpenBSD OpenSSH 1.2.3 |
Discussion
SSH client xauth Vulnerability
A vulnerability exists in the default configuration of the SSH client that could be used to compromise the security of a client machine. By default, ssh clients will negotiate to forward X connections. This is done using the xauth program to place cookies in the authorization cache of the remote machine for the user logging in. If the superuser on the remote host cannot be trusted, or the root account has been compromised, the xauth key can be read from the user's .Xauthority file, and used to connect to the client machine. This can result in a wide range of compromises on the client host.
A vulnerability exists in the default configuration of the SSH client that could be used to compromise the security of a client machine. By default, ssh clients will negotiate to forward X connections. This is done using the xauth program to place cookies in the authorization cache of the remote machine for the user logging in. If the superuser on the remote host cannot be trusted, or the root account has been compromised, the xauth key can be read from the user's .Xauthority file, and used to connect to the client machine. This can result in a wide range of compromises on the client host.
Exploit / POC
SSH client xauth Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
SSH client xauth Vulnerability
Solution:
Currently the SecurityFocus staff are not ware of any vendor supplied patches for SSH. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
A suitable fix is to disable X forwarding from being enabled by default. This can be permanantly done in the /etc/ssh_config file, or in $HOME/.ssh/config for individual hosts.
Host *
ForwardX11 no
OpenSSH has issued a new version that remedies this problem. Versions released after February 29, 2000 should not be susceptible. They are available at http://www.openssh.com/
Solution:
Currently the SecurityFocus staff are not ware of any vendor supplied patches for SSH. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
A suitable fix is to disable X forwarding from being enabled by default. This can be permanantly done in the /etc/ssh_config file, or in $HOME/.ssh/config for individual hosts.
Host *
ForwardX11 no
OpenSSH has issued a new version that remedies this problem. Versions released after February 29, 2000 should not be susceptible. They are available at http://www.openssh.com/