BID:2825

OpenSSH Client X11 Forwarding Cookie Removal File Symbolic Link Vulnerability

Info

OpenSSH Client X11 Forwarding Cookie Removal File Symbolic Link Vulnerability

Bugtraq ID:	2825
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Jun 04 2001 12:00AM
Updated:	Jun 04 2001 12:00AM
Credit:	This vulnerability was first announced to Bugtraq by zen-parse <[email protected]> on June 4, 2001.
Vulnerable:	OpenBSD OpenSSH 2.9 p1 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - HP HP-UX 11.11 - IBM AIX 4.3.3 - MandrakeSoft Corporate Server 1.0.1 - MandrakeSoft Single Network Firewall 7.2 - Mandriva Linux Mandrake 8.1 ia64 - Mandriva Linux Mandrake 8.1 - Mandriva Linux Mandrake 8.0 ppc - Mandriva Linux Mandrake 8.0 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.1 - Redhat Linux 7.1 - Redhat Linux 7.0 - Redhat Linux 6.2 - SCO eDesktop 2.4 - SCO eServer 2.3.1 - SGI IRIX 6.5.9 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 - SuSE Linux 7.1 - SuSE Linux 7.0 OpenBSD OpenSSH 2.9 + FreeBSD FreeBSD 4.4 + OpenBSD OpenBSD 2.9 OpenBSD OpenSSH 2.5.2 p2 + Redhat Linux 7.0 OpenBSD OpenSSH 2.5.2 OpenBSD OpenSSH 2.3.1 - OpenBSD OpenBSD 2.8 - OpenBSD OpenBSD 2.7 - OpenBSD OpenBSD 2.6 OpenBSD OpenSSH 2.2 .0 OpenBSD OpenSSH 2.1.1

Not Vulnerable:

Discussion

OpenSSH Client X11 Forwarding Cookie Removal File Symbolic Link Vulnerability

OpenSSH is the free implementation of the SSH client and server protocol. It is maintained by the OpenBSD project, and distributed freely as open source software.

A problem with OpenSSH makes it possible to delete arbitrary files. By connecting to a system over ssh and using X11 forwarding, a file is created in the /tmp directory as a result of the X11 forwarding. By linking the directory contained in /tmp to another directory containing the file "cookie", the cookie file will be removed by sshd upon termination of the session.

This makes it possible for a local user to arbitrary delete a cookie file belonging to another user.

Exploit / POC

OpenSSH Client X11 Forwarding Cookie Removal File Symbolic Link Vulnerability

See discussion.

Solution / Fix

OpenSSH Client X11 Forwarding Cookie Removal File Symbolic Link Vulnerability

Solution:
NetBSD Solution:

For NetBSD-current:

If you are using the in-tree sshd(8) in /usr/sbin/sshd, upgrade the binary using source code more recent than June 14, 2001. If you are using anonymous CVS, the following steps should upgrade the binaries.
# cd src
# cvs update -d -P crypto/dist/ssh usr.bin/ssh
# cd usr.bin/ssh
# make cleandir; make obj; make dependall
# make install

For NetBSD 1.5:

If you are using the in-tree sshd(8) in /usr/sbin/sshd, upgrade the binary using source code more recent than June 25, 2001. If you are using anonymous CVS, the following steps should upgrade the binaries.
# cd src
# cvs update -d -P -r netbsd-1-5 crypto/dist/ssh usr.bin/ssh
# cd usr.bin/ssh
# make cleandir; make obj; make dependall
# make install

NetBSD 1.5.1 is not vulnerable.

OpenBSD OpenSSH 2.1.1