CVE-2006-0883
CVSS5.0
发布时间 :2006-03-06 21:02:00
修订时间 :2011-08-26 00:00:00
NMCOPS    

[原文]OpenSSH on FreeBSD 5.3 and 5.4, when used with OpenPAM, does not properly handle when a forked child process terminates during PAM authentication, which allows remote attackers to cause a denial of service (client connection refusal) by connecting multiple times to the SSH server, waiting for the password prompt, then disconnecting.


[CNNVD]OpenSSH远程PAM拒绝服务漏洞(CNNVD-200603-063)

        OpenSSH是SSH协议组的实现,可为各种服务提供加密的认证传输,包括远程shell访问。OpenPAM是PAM架构的实现,允许使用可加载的模块实现管理员所定义的用户认证和会话管理。OpenSSH和FreeBSD中很多其他应用程序都使用OpenPAM提供一致的可配置的认证系统。
        OpenSSH与OpenPAM的进程交互机制上存在漏洞,远程攻击者可能利用此漏洞对OpenSSH执行拒绝服务攻击,导致OpenSSH无法处理正常请求。
        由于OpenSSH和OpenPAM之间存在设计冲突(一个是事件驱动而另一个为回调驱动),因此OpenSSH必须fork子进程以处理对PAM框架的调用。但是,如果非特权子进程终止而PAM认证仍然继续,父进程就会错误地相信PAM子进程也已终止。因此父进程就会终止,留下PAM子进程。
        根据OpenSSH执行内部计算的方法,主OpenSSH服务进程会将这些孤儿PAM子进程计算为尚未完成的连接。一旦累积了一定数目的孤儿进程的话,主进程就会认为已经过载,不再接受客户端连接。
        攻击者可以通过反复连接到有漏洞的服务器、等待口令提示并关闭连接导致OpenSSH停止接受客户端连接,直到系统重启或管理员手动杀死孤儿PAM进程。

- CVSS (基础分值)

CVSS分值: 5 [中等(MEDIUM)]
机密性影响: NONE [对系统的机密性无影响]
完整性影响: NONE [不会对系统完整性产生影响]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CWE (弱点类目)

CWE-399 [资源管理错误]

- CPE (受影响的平台与产品)

cpe:/o:freebsd:freebsd:5.4:releng
cpe:/o:freebsd:freebsd:5.3:release
cpe:/o:freebsd:freebsd:5.4:pre-release
cpe:/o:freebsd:freebsd:5.3FreeBSD 5.3
cpe:/a:openbsd:openssh:3.8.1p1OpenBSD OpenSSH 3.8.1 p1
cpe:/o:freebsd:freebsd:5.3:releng
cpe:/o:freebsd:freebsd:5.4:stable
cpe:/o:freebsd:freebsd:5.4:release
cpe:/o:freebsd:freebsd:5.3:stable

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0883
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-0883
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200603-063
(官方数据源) CNNVD

- 其它链接及资源

http://www.securityfocus.com/bid/16892
(PATCH)  BID  16892
http://securitytracker.com/id?1015706
(PATCH)  SECTRACK  1015706
http://xforce.iss.net/xforce/xfdb/25116
(UNKNOWN)  XF  openssh-openpam-dos(25116)
http://www.vupen.com/english/advisories/2006/0805
(VENDOR_ADVISORY)  VUPEN  ADV-2006-0805
http://www.osvdb.org/23797
(UNKNOWN)  OSVDB  23797
http://securityreason.com/securityalert/520
(UNKNOWN)  SREASON  520
http://bugzilla.mindrot.org/show_bug.cgi?id=839
(UNKNOWN)  CONFIRM  http://bugzilla.mindrot.org/show_bug.cgi?id=839
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:09.openssh.asc
(UNKNOWN)  FREEBSD  FreeBSD-SA-06:09

- 漏洞信息

OpenSSH远程PAM拒绝服务漏洞
中危 资源管理错误
2006-03-06 00:00:00 2006-03-17 00:00:00
远程  
        OpenSSH是SSH协议组的实现,可为各种服务提供加密的认证传输,包括远程shell访问。OpenPAM是PAM架构的实现,允许使用可加载的模块实现管理员所定义的用户认证和会话管理。OpenSSH和FreeBSD中很多其他应用程序都使用OpenPAM提供一致的可配置的认证系统。
        OpenSSH与OpenPAM的进程交互机制上存在漏洞,远程攻击者可能利用此漏洞对OpenSSH执行拒绝服务攻击,导致OpenSSH无法处理正常请求。
        由于OpenSSH和OpenPAM之间存在设计冲突(一个是事件驱动而另一个为回调驱动),因此OpenSSH必须fork子进程以处理对PAM框架的调用。但是,如果非特权子进程终止而PAM认证仍然继续,父进程就会错误地相信PAM子进程也已终止。因此父进程就会终止,留下PAM子进程。
        根据OpenSSH执行内部计算的方法,主OpenSSH服务进程会将这些孤儿PAM子进程计算为尚未完成的连接。一旦累积了一定数目的孤儿进程的话,主进程就会认为已经过载,不再接受客户端连接。
        攻击者可以通过反复连接到有漏洞的服务器、等待口令提示并关闭连接导致OpenSSH停止接受客户端连接,直到系统重启或管理员手动杀死孤儿PAM进程。

- 公告与补丁

        目前厂商已经发布了升级补丁以修复此安全问题,补丁获取链接:
        OpenBSD openssh-3.9p1.tar.gz
        ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-3.9p1.tar.gz

- 漏洞信息 (F44311)

FreeBSD-SA-06-09.openssh.txt (PacketStormID:F44311)
2006-03-03 00:00:00
 
advisory
freebsd
CVE-2006-0883
[点击下载]

FreeBSD Security Advisory FreeBSD-SA-06:09.openssh - Because OpenSSH and OpenPAM have conflicting designs (one is event-driven while the other is callback-driven), it is necessary for OpenSSH to fork a child process to handle calls to the PAM framework. However, if the unprivileged child terminates while PAM authentication is under way, the parent process incorrectly believes that the PAM child also terminated. The parent process then terminates, and the PAM child is left behind. Due to the way OpenSSH performs internal accounting, these orphaned PAM children are counted as pending connections by the master OpenSSH server process. Once a certain number of orphans has accumulated, the master decides that it is overloaded and stops accepting client connections.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=============================================================================
FreeBSD-SA-06:09.openssh                                    Security Advisory
                                                          The FreeBSD Project

Topic:          Remote denial of service in OpenSSH

Category:       contrib
Module:         OpenSSH
Announced:      2006-03-01
Affects:        FreeBSD 5.3 and 5.4
Corrected:      2006-03-01 14:19:48 UTC (RELENG_5, 5.5-PRERELEASE)
                2006-03-01 14:21:01 UTC (RELENG_5_4, 5.4-RELEASE-p12)
                2006-03-01 14:24:52 UTC (RELENG_5_3, 5.3-RELEASE-p27)
CVE Name:       CVE-2006-0883

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit
<URL:http://www.freebsd.org/security/>.

I.   Background

OpenSSH is an implementation of the SSH protocol suite, providing an
encrypted, authenticated transport for a variety of services,
including remote shell access.

Privilege separation is a mechanism used by OpenSSH to protect itself
against possible future vulnerabilities.  It works by splitting the
server process in two: the child process drops its privileges and
carries on the conversation with the client, while the parent retains
its privileges, monitors the child, and performs privileged operations
on behalf of the child when it is satisified that everything is in
order.  Privilege separation is enabled by default in FreeBSD.

OpenPAM is an implementation of the PAM framework, which allows the
use of loadable modules to implement user authentication and session
management in a manner defined by the administrator.  It is used by
OpenSSH and numerous other applications in FreeBSD to provide a
consistent and configurable authentication system.

II.  Problem Description

Because OpenSSH and OpenPAM have conflicting designs (one is event-
driven while the other is callback-driven), it is necessary for
OpenSSH to fork a child process to handle calls to the PAM framework.
However, if the unprivileged child terminates while PAM authentication
is under way, the parent process incorrectly believes that the PAM
child also terminated.  The parent process then terminates, and the
PAM child is left behind.

Due to the way OpenSSH performs internal accounting, these orphaned
PAM children are counted as pending connections by the master OpenSSH
server process.  Once a certain number of orphans has accumulated, the
master decides that it is overloaded and stops accepting client
connections.

III. Impact

By repeatedly connecting to a vulnerable server, waiting for a
password prompt, and closing the connection, an attacker can cause
OpenSSH to stop accepting client connections until the system restarts
or an administrator manually kills the orphaned PAM processes.

IV.  Workaround

The following command will show a list of orphaned PAM processes:

# pgrep -lf '\[pam\]'

The following command will kill orphaned PAM processes:

# pkill -f '\[pam\]'

To prevent OpenSSH from leaving orphaned PAM processes behind, perform
one of the following:

1) Disable PAM authentication in OpenSSH.  Users will still be able to
   log in using their Unix password, OPIE or SSH keys.

   To do this, execute the following commands as root:

# echo 'UsePAM no' >>/etc/ssh/sshd_config
# /etc/rc.d/sshd restart

2) If disabling PAM is not an option - if, for instance, you use
   RADIUS authentication, or store user passwords in an SQL database -
   you may instead disable privilege separation.  However, this may
   leave OpenSSH vulnerable to hitherto unknown bugs, and should be
   considered a last resort.

   To do this, execute the following commands as root:

# echo 'UsePrivilegeSeparation no' >>/etc/ssh/sshd_config
# /etc/rc.d/sshd restart

V.   Solution

Perform one of the following:

1) Upgrade your vulnerable system to 5-STABLE or to the RELENG_5_4 or
   RELENG_5_3 security branch dated after the correction date.

2) To patch your present system:

The following patches have been verified to apply to FreeBSD 5.3 and
5.4 systems.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:09/openssh.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:09/openssh.patch.asc

b) Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch
# cd /usr/src/secure/lib/libssh
# make obj && make depend && make && make install
# cd /usr/src/secure/usr.sbin/sshd
# make obj && make depend && make && make install
# /etc/rc.d/sshd restart

VI.  Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

Branch                                                           Revision
  Path
- -------------------------------------------------------------------------
RELENG_5
  src/crypto/openssh/auth-pam.c                                  1.14.2.1
  src/crypto/openssh/ssh_config                                  1.25.2.1
  src/crypto/openssh/ssh_config.5                                1.15.2.1
  src/crypto/openssh/sshd_config                                 1.40.2.1
  src/crypto/openssh/sshd_config.5                               1.21.2.1
  src/crypto/openssh/version.h                                   1.27.2.1
RELENG_5_4
  src/UPDATING                                            1.342.2.24.2.21
  src/sys/conf/newvers.sh                                  1.62.2.18.2.17
  src/crypto/openssh/auth-pam.c                                  1.14.6.1
  src/crypto/openssh/ssh_config                                  1.25.6.1
  src/crypto/openssh/ssh_config.5                                1.15.6.1
  src/crypto/openssh/sshd_config                                 1.40.6.1
  src/crypto/openssh/sshd_config.5                               1.21.6.1
  src/crypto/openssh/version.h                                   1.27.6.1
RELENG_5_3
  src/UPDATING                                            1.342.2.13.2.30
  src/sys/conf/newvers.sh                                  1.62.2.15.2.32
  src/crypto/openssh/auth-pam.c                                  1.14.4.1
  src/crypto/openssh/ssh_config                                  1.25.4.1
  src/crypto/openssh/ssh_config.5                                1.15.4.1
  src/crypto/openssh/sshd_config                                 1.40.4.1
  src/crypto/openssh/sshd_config.5                               1.21.4.1
  src/crypto/openssh/version.h                                   1.27.4.1
- -------------------------------------------------------------------------

VII. References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=248125
http://bugzilla.mindrot.org/show_bug.cgi?id=839
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0883

The latest revision of this advisory is available at
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:09.openssh.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (FreeBSD)

iD8DBQFEBbOEFdaIBMps37IRAghrAJ93wcvG5uGATpA8jDIQE0Dn8fF8iQCglz6r
DaXFHxKA7Xhc33smtuMlWNU=
=87jf
-----END PGP SIGNATURE-----
    

- 漏洞信息

23797
OpenSSH with OpenPAM Connection Saturation Forked Process Saturation DoS
Remote / Network Access Denial of Service, Input Manipulation
Loss of Availability
Exploit Public Vendor Verified

- 漏洞描述

OpenSSH, as used with OpenPAM on FreeBSD, and possibly other platforms, contains a flaw that may allow a remote attacker to cause a denial of service. The issue is due to the way each program handles forked processes and calls to the PAM resources. Due to this conflict, an attacker can make repeated connections to the OpenSSH service causing it to stop processing new connections.

- 时间线

2006-03-01 Unknow
Unknow Unknow

- 解决方案

Upgrade to version 3.9p1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

- 相关参考

- 漏洞作者

- 漏洞信息

OpenSSH Remote PAM Denial Of Service Vulnerability
Design Error 16892
Yes No
2006-03-01 12:00:00 2006-03-05 02:11:00
The original discoverer of this issue is currently unknown.

- 受影响的程序版本

OpenBSD OpenSSH 3.8.1 p1
FreeBSD FreeBSD 5.4 -RELENG
FreeBSD FreeBSD 5.4 -RELEASE
FreeBSD FreeBSD 5.4 -PRERELEASE
FreeBSD FreeBSD 5.3 -STABLE
FreeBSD FreeBSD 5.3 -RELENG
FreeBSD FreeBSD 5.3 -RELEASE
FreeBSD FreeBSD 5.3
FreeBSD FreeBSD 5.4-STABLE
OpenBSD OpenSSH 3.9 p1

- 不受影响的程序版本

OpenBSD OpenSSH 3.9 p1

- 漏洞讨论

OpenSSH is susceptible to a remote denial-of-service vulnerability. This issue is due to a design flaw when handling connections when configured to use OpenPAM authentication system.

This issue may be exploited by remote attackers to deny SSH service to legitimate users.

OpenSSH in conjunction with OpenPAM on FreeBSD versions 5.3 and 5.4 are affected by this issue. Other operating systems and versions may also be affected.

- 漏洞利用

Attackers likely utilize a standard OpenSSH client to exploit this issue.

- 解决方案

Please see the referenced vendor advisories for more information and fixes.


OpenBSD OpenSSH 3.8.1 p1

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站