BID:6407

Multiple Vendor SSH2 Implementation Buffer Overflow Vulnerabilities

Info

Multiple Vendor SSH2 Implementation Buffer Overflow Vulnerabilities

Bugtraq ID:	6407
Class:	Boundary Condition Error
CVE:	CVE-2002-1359
Remote:	Yes
Local:	No
Published:	Dec 16 2002 12:00AM
Updated:	Jul 11 2009 07:16PM
Credit:	Discovery of this vulnerability is credited to Rapid 7, Inc.
Vulnerable:	WinSCP WinSCP 2.0 .0 Simon Tatham PuTTY 0.53 Simon Tatham PuTTY 0.49 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 Simon Tatham PuTTY 0.48 Pragma Systems SecureShell 2.0 NetComposite Shellguard SSH 3.4.6 InterSoft SecureNetTerm 5.4.1 FiSSH SSH Client For Windows 1.0 A Cisco WebNS 7.10 Cisco WebNS 7.1 0.2.06 + Cisco CSS11000 Content Services Switch + Cisco CSS11050 Content Services Switch + Cisco CSS11150 Content Services Switch + Cisco CSS11501 Content Services Switch + Cisco CSS11503 Content Services Switch + Cisco CSS11506 Content Services Switch + Cisco CSS11800 Content Services Switch Cisco WebNS 7.1 0.1.02 + Cisco CSS11000 Content Services Switch + Cisco CSS11050 Content Services Switch + Cisco CSS11150 Content Services Switch + Cisco CSS11501 Content Services Switch + Cisco CSS11503 Content Services Switch + Cisco CSS11506 Content Services Switch + Cisco CSS11800 Content Services Switch Cisco WebNS 5.20 Cisco WebNS 5.10 Cisco WebNS 5.1 0.0.10 + Cisco CSS11000 Content Services Switch + Cisco CSS11050 Content Services Switch + Cisco CSS11150 Content Services Switch + Cisco CSS11501 Content Services Switch + Cisco CSS11503 Content Services Switch + Cisco CSS11506 Content Services Switch + Cisco CSS11800 Content Services Switch Cisco PIX Firewall 6.2.2 .111 Cisco PIX Firewall 6.2.2 Cisco PIX Firewall 6.2.1 Cisco PIX Firewall 6.2 (2) Cisco PIX Firewall 6.2 (1) Cisco PIX Firewall 6.2 Cisco PIX Firewall 6.1.4 Cisco PIX Firewall 6.1.3 Cisco PIX Firewall 6.1 (4) Cisco PIX Firewall 6.1 (3) Cisco PIX Firewall 6.1 (2) Cisco PIX Firewall 6.1 (1) Cisco PIX Firewall 6.1 Cisco PIX Firewall 6.0.4 Cisco PIX Firewall 6.0.3 Cisco PIX Firewall 6.0 (4) Cisco PIX Firewall 6.0 (2) Cisco PIX Firewall 6.0 (1) Cisco PIX Firewall 6.0 Cisco ONS 15600 1.3 (0) Cisco ONS 15600 1.1 (1) Cisco ONS 15600 1.1 (0) Cisco ONS 15600 1.1 Cisco ONS 15600 1.0 Cisco ONS 15454SDH 4.6 (1) Cisco ONS 15454SDH 4.6 (0) Cisco ONS 15454SDH 4.5 Cisco ONS 15454SDH 4.1 (3) Cisco ONS 15454SDH 4.1 (2) Cisco ONS 15454SDH 4.1 (1) Cisco ONS 15454SDH 4.1 (0) Cisco ONS 15454SDH 4.0 (2) Cisco ONS 15454SDH 4.0 (1) Cisco ONS 15454SDH 4.0 (0) Cisco ONS 15454SDH 4.0 Cisco ONS 15454SDH 3.4 Cisco ONS 15454SDH 3.3 Cisco ONS 15454SDH 3.2 Cisco ONS 15454SDH 3.1 Cisco ONS 15454SDH 2.3 (5) Cisco ONS 15454E Optical Transport Platform 0 Cisco ONS 15454 Optical Transport Platform 4.14 Cisco ONS 15454 Optical Transport Platform 4.6 (1) Cisco ONS 15454 Optical Transport Platform 4.6 (0) Cisco ONS 15454 Optical Transport Platform 4.5 Cisco ONS 15454 Optical Transport Platform 4.1 (3) Cisco ONS 15454 Optical Transport Platform 4.1 (2) Cisco ONS 15454 Optical Transport Platform 4.1 (1) Cisco ONS 15454 Optical Transport Platform 4.1 (0) Cisco ONS 15454 Optical Transport Platform 4.1 Cisco ONS 15454 Optical Transport Platform 4.0 (2) Cisco ONS 15454 Optical Transport Platform 4.0 (1) Cisco ONS 15454 Optical Transport Platform 4.0 Cisco ONS 15454 Optical Transport Platform 3.4 Cisco ONS 15454 Optical Transport Platform 3.3 Cisco ONS 15454 Optical Transport Platform 3.2 .0 Cisco ONS 15454 Optical Transport Platform 3.1 .0 Cisco ONS 15454 Optical Transport Platform 3.0 Cisco ONS 15454 Optical Transport Platform 2.3 (5) Cisco ONS 15454 IOS-Based Blades Cisco ONS 15327 Metro Edge Optical Transport Platform Cisco ONS 15327 4.14 Cisco ONS 15327 4.6 (1) Cisco ONS 15327 4.6 (0) Cisco ONS 15327 4.1 (3) Cisco ONS 15327 4.1 (2) Cisco ONS 15327 4.1 (1) Cisco ONS 15327 4.1 (0) Cisco ONS 15327 4.0 (2) Cisco ONS 15327 4.0 (1) Cisco ONS 15327 4.0 Cisco ONS 15327 3.4 Cisco ONS 15327 3.3 Cisco ONS 15327 3.2 Cisco ONS 15327 3.1 Cisco ONS 15327 3.0 Cisco IOS 12.2T Cisco IOS 12.2S Cisco IOS 12.2(1)T Cisco IOS 12.2(1)S Cisco IOS 12.2(1) Cisco IOS 12.2 Cisco IOS 12.1T Cisco IOS 12.1EA Cisco IOS 12.1E Cisco IOS 12.1(5a)E Cisco IOS 12.1(1)T Cisco IOS 12.0ST Cisco IOS 12.0S Cisco IOS 12.0(5)S Cisco IOS 12.0(16)ST Cisco Firewall Services Module (FWSM) 2.1 (0.208) Cisco Aironet Firmware 12.0 1T Cisco Aironet Firmware 12.0 0T

Not Vulnerable:	Simon Tatham PuTTY 0.53 b Pragma Systems SecureShell 3.0 OpenSSH OpenSSH 3.5 OpenSSH OpenSSH 3.4 p1 + Conectiva Linux Enterprise Edition 1.0 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + FreeBSD FreeBSD 5.0 + FreeBSD FreeBSD 4.7 -RELEASE + FreeBSD FreeBSD 4.7 + IBM AIX 5.1 L + IBM AIX 4.3.3 + Immunix Immunix OS 7+ + Redhat Linux 8.0 + Slackware Linux 8.1 + SuSE Linux 8.1 + SuSE Linux 8.0 OpenSSH OpenSSH 3.4 OpenSSH OpenSSH 3.3 p1 OpenSSH OpenSSH 3.3 + Openwall Openwall GNU//Linux (Owl)-current OpenSSH OpenSSH 3.2.3 p1 OpenSSH OpenSSH 3.2.2 p1 + Apple Mac OS X 10.1.5 + Apple Mac OS X 10.1.4 + Apple Mac OS X 10.1.3 + Apple Mac OS X 10.1.2 + Apple Mac OS X 10.1.1 + Apple Mac OS X 10.1 + Apple Mac OS X 10.1 + Apple Mac OS X 10.0.4 + Apple Mac OS X 10.0.3 + Apple Mac OS X 10.0.2 + Apple Mac OS X 10.0.1 + Apple Mac OS X 10.0 OpenSSH OpenSSH 3.2 + OpenBSD OpenBSD 3.1 OpenSSH OpenSSH 3.1 p1 + Juniper NetScreen-IDP 10 3.0 r2 + Juniper NetScreen-IDP 10 3.0 r1 + Juniper NetScreen-IDP 10 3.0 + Juniper NetScreen-IDP 100 3.0 r2 + Juniper NetScreen-IDP 100 3.0 r1 + Juniper NetScreen-IDP 100 3.0 + Juniper NetScreen-IDP 1000 3.0 r2 + Juniper NetScreen-IDP 1000 3.0 r1 + Juniper NetScreen-IDP 1000 3.0 + Juniper NetScreen-IDP 500 3.0 r2 + Juniper NetScreen-IDP 500 3.0 r1 + Juniper NetScreen-IDP 500 3.0 + Redhat Enterprise Linux AS 2.1 IA64 + Redhat Enterprise Linux AS 2.1 + Redhat Enterprise Linux ES 2.1 IA64 + Redhat Enterprise Linux ES 2.1 + Redhat Enterprise Linux WS 2.1 IA64 + Redhat Enterprise Linux WS 2.1 + Redhat Linux 7.3 + Redhat Linux 7.2 + Redhat Linux 7.1 + Redhat Linux for iSeries 7.1 + Redhat Linux for pSeries 7.1 + Slackware Linux 8.1 + Sun Linux 5.0.7 + Sun Solaris 9 + Trustix Secure Linux 1.5 + Trustix Secure Linux 1.2 + Trustix Secure Linux 1.1 OpenSSH OpenSSH 3.1 OpenSSH OpenSSH 3.0.2 p1 + Guardian Digital Engarde Secure Linux 1.0.1 + HP VirtualVault 4.6 OpenSSH OpenSSH 3.0.2 - Debian Linux 3.0 + FreeBSD FreeBSD 4.5 -STABLEpre2002-03-07 + FreeBSD FreeBSD 4.5 -RELEASE + OpenPKG OpenPKG 1.0 + Openwall Openwall GNU//Linux 0.1 -stable + SuSE Linux 8.0 OpenSSH OpenSSH 3.0.1 p1 OpenSSH OpenSSH 3.0.1 OpenSSH OpenSSH 3.0 p1 OpenSSH OpenSSH 3.0 LSH LSH 1.5 InterSoft SecureNetTerm 5.4.2 Cisco WebNS 7.10 .0.06s Cisco WebNS 5.20 .0.06s Cisco PIX Firewall 6.3 (1) Cisco PIX Firewall 6.2 (3) Cisco PIX Firewall 6.1 (5) Cisco PIX Firewall 6.0 (4.101) Cisco IOS 12.2(14)S Cisco IOS 12.2(13a) Cisco IOS 12.2(13)T1 Cisco IOS 12.2(12b) Cisco IOS 12.2(11)T3 Cisco IOS 12.1(14)E1 Cisco IOS 12.1(13)EA1c Cisco IOS 12.1(13)E3 Cisco IOS 12.0(23)S2 Cisco IOS 12.0(22)S4 Cisco IOS 12.0(21)ST6 Cisco IOS 12.0(21)S6 Cisco IOS 12.0(20)ST7 Cisco Aironet Firmware 12.0 1T1 BitVise WinSSHD 3.5

Discussion

Multiple Vendor SSH2 Implementation Buffer Overflow Vulnerabilities

Multiple vendor SSH2 implementations are reported to be prone to buffer overflows. These buffer overflows are alleged to be exploitable prior to authentication.

These conditions were discovered during tests of the initialization, key exchange, and negotiation phases (KEX, KEXINIT) of a SSH2 transaction between client and server. These issues are known to affect various client and server implementations of the protocol.

Successful exploitation will enable remote attackers to cause execution of code in the security context of the specific server and client implementations.

Further details about this vulnerability are currently unknown. This BID will be updated as more information becomes available. This vulnerability was originally described in BugTraq ID 6397.

Exploit / POC

Multiple Vendor SSH2 Implementation Buffer Overflow Vulnerabilities

The SSHredder test suite, provided by Rapid 7, is available from the following location:

http://www.rapid7.com/perl/DownloadRequest.pl?PackageChoice=666

Proof-of-concept code has been published. The following program will act as a malicious server to exploit vulnerable 'putty' clients.

/data/vulnerabilities/exploits/IP-putty.c
/data/vulnerabilities/exploits/IP-putty.c

Solution / Fix

Multiple Vendor SSH2 Implementation Buffer Overflow Vulnerabilities

Solution:
Cray Inc. supports an OpenSSH implementation via the Cray Open Software (COS) package. COS 3.3 will reportedly address these issues and is expected to be released at the end of December 2002. Those affected by the issues may also contact Cray Inc. to obtain a fixed version of the OpenSSH implementation that will be made available in COS 3.3.

SSH Secure Shell products do not appear to be prone to any of the vulnerabilities that have been reported.

F-Secure SSH products are not vulnerable to arbitrary code execution or denial of service attacks via exploitation of these issues.

Some versions of Cisco IOS support SSH, though it is not enabled by default. Fixed versions have been made available. See the referenced advisory for more information.

Cisco has released an updated advisory. Cisco Aironet software rebuild version 12.01T1 is not vulnerable to this issue. This software will be available in the near future and will be available for download from the Software Center.

http://www.cisco.com/tacpage/sw-center/sw-wireless.shtml

Cisco has released Content Switching Software updates. WebNS 5.20.0.06s and 7.10.0.06s address the issues. These updates can be found at the following location:

http://www.cisco.com/tacpage/sw-center/sw-content.shtml

Cisco has updated their advisory to include Cisco PIX Firewall as being vulnerable. PIX Firewall has been fixed in software versions 6.0(4.101), 6.1(5), 6.2(3) and 6.3(1).

Cisco has released an updated advisory to outline vulnerable Cisco ONS products and fixes. Please see the referenced advisory for more information.

The following vendors have provided fixes:

Cisco IOS 12.2T