OpenSSH Challenge-Response Buffer Overflow Vulnerabilities

BID:5093

Info

OpenSSH Challenge-Response Buffer Overflow Vulnerabilities

Bugtraq ID: 5093
Class: Boundary Condition Error
CVE: CVE-2002-0639
CVE-2002-0640
Remote: Yes
Local: No
Published: Jun 24 2002 12:00AM
Updated: Nov 05 2007 02:45PM
Credit: Credited to Mark Dowd of the ISS X-Force. Credit is also given to Global InterSec LLC for discovering an additional issue.
Vulnerable: Sun Solaris 9
OpenSSH OpenSSH 3.3 p1
OpenSSH OpenSSH 3.3
+ Openwall Openwall GNU/*/Linux (Owl)-current
 OpenSSH OpenSSH 3.2.3 p1
OpenSSH OpenSSH 3.2.2 p1
+ Apple Mac OS X 10.1.5
+ Apple Mac OS X 10.1.4
+ Apple Mac OS X 10.1.3
+ Apple Mac OS X 10.1.2
+ Apple Mac OS X 10.1.1
+ Apple Mac OS X 10.1
+ Apple Mac OS X 10.1
+ Apple Mac OS X 10.0.4
+ Apple Mac OS X 10.0.3
+ Apple Mac OS X 10.0.2
+ Apple Mac OS X 10.0.1
+ Apple Mac OS X 10.0
OpenSSH OpenSSH 3.2
+ OpenBSD OpenBSD 3.1
 OpenSSH OpenSSH 3.1 p1
+ Juniper NetScreen-IDP 10 3.0 r2
 + Juniper NetScreen-IDP 10 3.0 r1
 + Juniper NetScreen-IDP 10 3.0
+ Juniper NetScreen-IDP 100 3.0 r2
 + Juniper NetScreen-IDP 100 3.0 r1
 + Juniper NetScreen-IDP 100 3.0
+ Juniper NetScreen-IDP 1000 3.0 r2
 + Juniper NetScreen-IDP 1000 3.0 r1
 + Juniper NetScreen-IDP 1000 3.0
+ Juniper NetScreen-IDP 500 3.0 r2
 + Juniper NetScreen-IDP 500 3.0 r1
 + Juniper NetScreen-IDP 500 3.0
+ Redhat Enterprise Linux AS 2.1 IA64
 + Redhat Enterprise Linux AS 2.1
 + Redhat Enterprise Linux ES 2.1 IA64
 + Redhat Enterprise Linux ES 2.1
 + Redhat Enterprise Linux WS 2.1 IA64
 + Redhat Enterprise Linux WS 2.1
 + Redhat Linux 7.3
+ Redhat Linux 7.2
+ Redhat Linux 7.1
+ Redhat Linux for iSeries 7.1
+ Redhat Linux for pSeries 7.1
+ Slackware Linux 8.1
+ Sun Linux 5.0.7
+ Sun Solaris 9
 + Trustix Secure Linux 1.5
+ Trustix Secure Linux 1.2
+ Trustix Secure Linux 1.1
OpenSSH OpenSSH 3.1
OpenSSH OpenSSH 3.0.2 p1
+ Guardian Digital Engarde Secure Linux 1.0.1
+ HP VirtualVault 4.6
OpenSSH OpenSSH 3.0.2
- Debian Linux 3.0
+ FreeBSD FreeBSD 4.5 -STABLEpre2002-03-07
 + FreeBSD FreeBSD 4.5 -RELEASE
 + OpenPKG OpenPKG 1.0
+ Openwall Openwall GNU/*/Linux 0.1 -stable
 + SuSE Linux 8.0
OpenSSH OpenSSH 3.0.1 p1
OpenSSH OpenSSH 3.0.1
OpenSSH OpenSSH 3.0 p1
OpenSSH OpenSSH 3.0
OpenSSH OpenSSH 2.9.9
+ NetBSD NetBSD 1.5.2
+ SuSE Linux 7.3 sparc
 + SuSE Linux 7.3 ppc
 + SuSE Linux 7.3 i386
 + SuSE Linux 7.2
OpenSSH OpenSSH 2.9 p2
+ Caldera OpenLinux Server 3.1.1
+ Caldera OpenLinux Server 3.1
+ Caldera OpenLinux Workstation 3.1.1
+ Caldera OpenLinux Workstation 3.1
+ FreeBSD FreeBSD 4.4 -RELENG
 + HP Secure OS software for Linux 1.0
+ Immunix Immunix OS 7.0
+ MandrakeSoft Corporate Server 1.0.1
+ MandrakeSoft Single Network Firewall 7.2
+ Mandriva Linux Mandrake 8.1
+ Mandriva Linux Mandrake 8.0 ppc
 + Mandriva Linux Mandrake 8.0
+ Mandriva Linux Mandrake 7.2
+ Mandriva Linux Mandrake 7.1
+ Redhat Linux 7.2
+ Redhat Linux 7.1
+ Redhat Linux 7.0
+ Sun Cobalt RaQ 550
- SuSE Linux 7.3 sparc
 - SuSE Linux 7.3 ppc
 - SuSE Linux 7.3 i386
 - SuSE Linux 7.2 i386
 - SuSE Linux 7.1 x86
 - SuSE Linux 7.1 sparc
 - SuSE Linux 7.1 ppc
 - SuSE Linux 7.1 alpha
 OpenSSH OpenSSH 2.9 p1
- IBM AIX 4.3.3
- IBM AIX 4.3.2
- IBM AIX 4.3.1
- IBM AIX 4.3
OpenSSH OpenSSH 2.9
+ FreeBSD FreeBSD 4.6 -RELEASE
 + FreeBSD FreeBSD 4.6
+ FreeBSD FreeBSD 4.5 -RELEASE
 + FreeBSD FreeBSD 4.5
OpenSSH OpenSSH 2.5.2
- Caldera OpenUnix 8.0
- Caldera UnixWare 7.1.1
- Wirex Immunix OS 6.2
OpenSSH OpenSSH 2.5.1
+ NetBSD NetBSD 1.5.1
+ S.u.S.E. Linux Database Server 0
 + S.u.S.E. Linux Firewall on CD
+ S.u.S.E. SuSE eMail Server III
- SCO Open Server 5.0.6 a
 - SCO Open Server 5.0.6
- SCO Open Server 5.0.5
- SCO Open Server 5.0.4
- SCO Open Server 5.0.3
- SCO Open Server 5.0.2
- SCO Open Server 5.0.1
- SCO Open Server 5.0
+ SuSE Linux 7.3
+ SuSE Linux 7.2
+ SuSE Linux 7.1
+ SuSE SUSE Linux Enterprise Server 7
 OpenSSH OpenSSH 2.5
OpenSSH OpenSSH 2.3
- SuSE Linux 7.0 sparc
 - SuSE Linux 7.0 ppc
 - SuSE Linux 7.0 i386
 - SuSE Linux 7.0 alpha
 - SuSE Linux 6.4 ppc
 - SuSE Linux 6.4 i386
 - SuSE Linux 6.4 alpha
 OpenSSH OpenSSH 2.2
+ NetBSD NetBSD 1.5
OpenSSH OpenSSH 2.1.1
+ SuSE Linux 7.0 sparc
 + SuSE Linux 7.0 ppc
 + SuSE Linux 7.0 i386
 + SuSE Linux 7.0 alpha
 OpenSSH OpenSSH 2.1
OpenSSH OpenSSH 1.2.3
+ Blue Coat Systems Security Gateway OS 2.1.5001 SP1
 OpenSSH OpenSSH 1.2.2
OpenBSD OpenBSD 3.1
OpenBSD OpenBSD 3.0
IBM Linux Affinity Toolkit
- IBM AIX 4.3.3
- IBM AIX 4.3.2
- IBM AIX 4.3.1
- IBM AIX 4.3
- IBM AIX 5.1
 HP HP-UX Secure Shell A.03.10
+ HP HP-UX 11.11
+ HP HP-UX 11.0
Not Vulnerable: OpenSSH OpenSSH 3.4 p1
+ Conectiva Linux Enterprise Edition 1.0
+ Debian Linux 3.0 sparc
 + Debian Linux 3.0 s/390
 + Debian Linux 3.0 ppc
 + Debian Linux 3.0 mipsel
 + Debian Linux 3.0 mips
 + Debian Linux 3.0 m68k
 + Debian Linux 3.0 ia-64
 + Debian Linux 3.0 ia-32
 + Debian Linux 3.0 hppa
 + Debian Linux 3.0 arm
 + Debian Linux 3.0 alpha
 + FreeBSD FreeBSD 5.0
+ FreeBSD FreeBSD 4.7 -RELEASE
 + FreeBSD FreeBSD 4.7
+ IBM AIX 5.1 L
 + IBM AIX 4.3.3
+ Immunix Immunix OS 7+
 + Redhat Linux 8.0
+ Slackware Linux 8.1
+ SuSE Linux 8.1
+ SuSE Linux 8.0
OpenSSH OpenSSH 3.4
HP HP-UX Secure Shell A.03.10.002

Discussion

OpenSSH Challenge-Response Buffer Overflow Vulnerabilities

The OpenSSH team has reported two vulnerabilities in OpenSSH that are remotely exploitable and may allow for unauthenticated attackers to obtain root privileges.

The conditions are related to the OpenSSH SSH2 challenge-response mechanism. They occur when the OpenSSH server is configured at compile time to support BSD_AUTH or SKEY. OpenBSD 3.0 and later ship with OpenSSH built to support BSD_AUTH. Systems are vulnerable when either of the following configuration options are enabled:

PAMAuthenticationViaKbdInt
ChallengeResponseAuthentication

Attackers can exploit the vulnerabilities by crafting a malicious response. Since this occurs before the authentication process completes, remote attackers without valid credentials may exploit this. Successful exploits may result in the execution of shellcode or a denial of service.

OpenSSH 3.4 addresses the problem. Upgrading to this version will eliminate the vulnerabilities. Administrators who cannot install OpenSSH 3.4 should upgrade to version 3.3 and enable the privilege-separation feature.

Proof-of-concept code has been made public. Users are advised to upgrade immediately.

**UPDATE: One of these issues is trivially exploitable and is still present in OpenSSH 3.5p1 and 3.4p1. Although these reports have not been confirmed, administrators are advised to implement the OpenSSH privilege-separation feature as a workaround. BSD administrators are also advised to upgrade to the newest kernel versions because recently patched vulnerabilities may allow root compromise despite the use of the privilege-separation feature.

Exploit / POC

OpenSSH Challenge-Response Buffer Overflow Vulnerabilities

Joe Testa <[email protected]> has provided information on how a server segmentation fault may be produced with the use of a modified, malicious SSH client. Details are available in the referenced Bugtraq message post.

Christophe Devine <[email protected]> has published a proof-of-concept exploit (as a patch to the OpenSSH client).

GOBBLES has also released proof-of-concept code.

UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

Solution / Fix

OpenSSH Challenge-Response Buffer Overflow Vulnerabilities

Solution:
OpenSSH 3.4 has been released. Although it should contain the fix, administrators are still advised to enable privilege separation as a preventative measure.

The OpenSSH development team has stated that OpenSSH 3.2 (and later) servers configured to use the new privilege separation feature are not exploitable. Privilege separation was introduced in OpenSSH 3.2. Administrators of systems using earlier versions are *strongly* urged to upgrade to OpenSSH 3.2 or later and enable privilege separation. Privilege separation is enabled by default in OpenSSH 3.3.

Please see the references for more information.


IBM Linux Affinity Toolkit

HP HP-UX Secure Shell A.03.10

OpenSSH OpenSSH 1.2.2

OpenSSH OpenSSH 1.2.3

OpenSSH OpenSSH 2.1

OpenSSH OpenSSH 2.1.1

OpenSSH OpenSSH 2.2

OpenSSH OpenSSH 2.3

OpenSSH OpenSSH 2.5

OpenSSH OpenSSH 2.5.1

OpenSSH OpenSSH 2.5.2

OpenSSH OpenSSH 2.9

OpenSSH OpenSSH 2.9 p1

OpenSSH OpenSSH 2.9 p2

OpenSSH OpenSSH 2.9.9

OpenSSH OpenSSH 3.0

OpenSSH OpenSSH 3.0.1

OpenSSH OpenSSH 3.0.2 p1

OpenSSH OpenSSH 3.0.2

OpenSSH OpenSSH 3.1

OpenSSH OpenSSH 3.1 p1

OpenSSH OpenSSH 3.2

OpenSSH OpenSSH 3.3

OpenSSH OpenSSH 3.3 p1

References

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report