SSH1 SSH Daemon Logging Failure Vulnerability

Bugtraq ID:	2345
Class:	Design Error
CVE:	CVE-2001-0471
Remote:	Yes
Local:	No
Published:	Feb 05 2001 12:00AM
Updated:	Jul 11 2009 04:46AM
Credit:	This vulnerability was announced to Bugtraq by Jose Nazario <[email protected]> in a Crimelabs Security Note on February 5, 2001.
Vulnerable:	SSH Communications Security SSH 1.2.30 - BSDI BSD/OS 4.0.1 - BSDI BSD/OS 4.0 - BSDI BSD/OS 3.1 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Digital (Compaq) TRU64/DIGITAL UNIX 5.0 - Digital (Compaq) TRU64/DIGITAL UNIX 4.0 g - FreeBSD FreeBSD 4.2 - FreeBSD FreeBSD 3.5.1 - HP HP-UX 11.11 - HP HP-UX 11.0 - HP HP-UX 10.20 - IBM AIX 4.3.3 - IBM AIX 4.3.2 - IBM AIX 4.3.1 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - OpenBSD OpenBSD 2.8 - Redhat Linux 7.0 - Redhat Linux 6.2 - SCO eDesktop 2.4 - SCO eServer 2.3.1 - Sun Solaris 2.5.1 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 - SuSE Linux 7.0 - SuSE Linux 6.4
Not Vulnerable:

SSH1 SSH Daemon Logging Failure Vulnerability

Exploit contributed by Jose Nazario <[email protected]> .

• /data/vulnerabilities/exploits/ssh1-log-exp

SSH1 SSH Daemon Logging Failure Vulnerability

Solution:
Patch supplied by Jose Nazario <[email protected]> :

--- ssh-1.2.30/sshd.c.orig Wed Jan 31 12:11:08 2001
+++ ssh-1.2.30/sshd.c Wed Jan 31 12:57:36 2001
@@ -2408,7 +2408,7 @@
remote_user_name = client_user;
break;
}
- debug("Rhosts authentication failed for '%.100s', remote '%.100s', host '%.200s'.",
+ log_msg("Rhosts authentication failed for '%.100s', remote '%.100s', host '%.200s'.",
user, client_user, get_canonical_hostname());
xfree(client_user);
break;
@@ -2469,7 +2469,7 @@
mpz_clear(&client_host_key_n);
break;
}
- debug("RhostsRSA authentication failed for '%.100s', remote '%.100s', host '%.200s'.",
+ log_msg("RhostsRSA authentication failed for '%.100s', remote '%.100s', host '%.200s'.",
user, client_user, get_canonical_hostname());
xfree(client_user);
mpz_clear(&client_host_key_e);
@@ -2500,7 +2500,7 @@
break;
}
mpz_clear(&n);
- debug("RSA authentication for %.100s failed.", user);
+ log_msg("RSA authentication for %.100s failed.", user);
}
break;

@@ -2633,7 +2633,7 @@
authenticated = 1;
break;
} else {
- debug("TIS authentication for %.100s failed",user);
+ log_msg("TIS authentication for %.100s failed",user);
memset(password, 0, strlen(password));
xfree(password);
break;
@@ -2672,7 +2672,7 @@
if (password_attempts > 0)
{
/* Log failures if attempted more than once. */
- debug("Password authentication failed for user %.100s from %.100s.",
+ log_msg("Password authentication failed for user %.100s from %.100s.",

user, get_canonical_hostname());
}
password_attempts++;
@@ -2693,7 +2693,7 @@
authenticated = 1;
break;
}
- debug("Password authentication for %.100s failed.", user);
+ log_msg("Password authentication for %.100s failed.", user);
memset(password, 0, strlen(password));
xfree(password);
break;


SSH Communications Security SSH 1.2.30

• SSH Communications ssh 1.2.31.tar.gz
  ftp://ftp.ssh.com/pub/ssh/ssh-1.2.31.tar.gz