OpenSSH ‘Channel’代码实现off-by-one漏洞

漏洞信息详情

OpenSSH ‘Channel’代码实现off-by-one漏洞

漏洞简介

OpenSSH是一个对SSH协议开放源码的,免费的实现。它对所有网络通讯进行加密传输,从而避开了许多网络层的攻击,是个很有用的网络连接工具。
OpenSSH实现上存在缓冲区溢出漏洞,一个有合法登录帐号的用户可以利用此漏洞得到主机的root权限。
为了实现X11、TCP和代理转发,OpenSSH在一个TCP连接上复用多个\”channel\”。OpenSSH在管理\”channel\”的代码实现上存在一个off-by-one(偏移一个单位)漏洞,程序可能会错误地使用正常范围之外的内存数据,一个有合法登录帐号的攻击者登录到系统以后可以利用此漏洞让sshd以root权限执行任意指令。一个恶意的ssh服务器也可能利用此漏洞在用户的客户机上执行任意指令。

漏洞公告

临时解决方法:
如果您不能立刻安装补丁或者升级,CNNVD建议您采取以下措施以降低威胁:

* 此问题没有好的临时解决方法,您应该尽快升级软件。如果不能及时升级,您应该限制不可信用户对sshd的访问。

* 您也可以使用下列补丁:

— channels_old.c Mon Mar 4 02:07:06 2002

+++ channels.c Mon Mar 4 02:07:16 2002

@@ -151,7 +151,7 @@

channel_lookup(int id)

{

Channel *c;

– if (id < 0 || id > channels_alloc) {

+ if (id < 0 || id >= channels_alloc) {

log(“channel_lookup: %d: bad id”, id);

return NULL;

}
厂商补丁:
Caldera
——-
Caldera已经为此发布了一个安全公告(CSSA-2002-SCO.10)以及相应补丁:

CSSA-2002-SCO.10:OpenServer: OpenSSH channel code vulnerability

链接:ftp://stage.caldera.com/pub/security/openunix/CSSA-2002-SCO.10

补丁下载:

OpenServer:

ftp://stage.caldera.com/pub/security/openserver/CSSA-2002-SCO.10/openssh-3.1p1-VOLS.tar

从上述地址将补丁下载到/tmp目录下并展开:

# cd /tmp

# tar xvf openssh-3.1p1-VOLS.tar

运行custom命令,指定从媒介映像中安装,将/tmp目录作为映像所在位置。
Conectiva
———
Conectiva已经为此发布了一个安全公告(CLA-2002:467)以及相应补丁:

CLA-2002:467:openssh

链接:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000467” target=”_blank”>
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000467

补丁下载:

ftp://atualizacoes.conectiva.com.br/5.0/SRPMS/openssh-3.0.2p1-1U50_2cl.src.rpm

ftp://atualizacoes.conectiva.com.br/5.0/i386/openssh-3.0.2p1-1U50_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/5.0/i386/openssh-askpass-3.0.2p1-1U50_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/5.0/i386/openssh-askpass-gnome-3.0.2p1-1U50_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/5.0/i386/openssh-clients-3.0.2p1-1U50_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/5.0/i386/openssh-server-3.0.2p1-1U50_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/5.1/SRPMS/openssh-3.0.2p1-1U51_2cl.src.rpm

ftp://atualizacoes.conectiva.com.br/5.1/i386/openssh-3.0.2p1-1U51_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/5.1/i386/openssh-askpass-3.0.2p1-1U51_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/5.1/i386/openssh-askpass-gnome-3.0.2p1-1U51_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/5.1/i386/openssh-clients-3.0.2p1-1U51_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/5.1/i386/openssh-server-3.0.2p1-1U51_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/openssh-3.0.2p1-1U60_2cl.src.rpm

ftp://atualizacoes.conectiva.com.br/6.0/RPMS/openssh-3.0.2p1-1U60_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/6.0/RPMS/openssh-askpass-3.0.2p1-1U60_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/6.0/RPMS/openssh-askpass-gnome-3.0.2p1-1U60_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/6.0/RPMS/openssh-clients-3.0.2p1-1U60_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/6.0/RPMS/openssh-server-3.0.2p1-1U60_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/openssh-3.0.2p1-1U70_2cl.src.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/openssh-3.0.2p1-1U70_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/openssh-askpass-3.0.2p1-1U70_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/openssh-askpass-gnome-3.0.2p1-1U70_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/openssh-clients-3.0.2p1-1U70_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/openssh-server-3.0.2p1-1U70_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/SRPMS/openssh-3.0.2p1-1U50_2cl.src.rpm

ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/openssh-3.0.2p1-1U50_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/openssh-askpass-3.0.2p1-1U50_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/openssh-askpass-gnome-3.0.2p1-1U50_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/openssh-clients-3.0.2p1-1U50_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/openssh-server-3.0.2p1-1U50_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/SRPMS/openssh-3.0.2p1-1U50_2cl.src.rpm


来源: ENGARDE
名称: ESA-20020307-007
链接:http://www.linuxsecurity.com/advisories/other_advisory-1937.html

来源: BID
名称: 4241
链接:http://www.securityfocus.com/bid/4241

来源: REDHAT
名称: RHSA-2002:043
链接:http://www.redhat.com/support/errata/RHSA-2002-043.html

来源: OSVDB
名称: 730
链接:http://www.osvdb.org/730

来源: www.openbsd.org
链接:http://www.openbsd.org/advisories/ssh_channelalloc.txt

来源: SUSE
名称: SuSE-SA:2002:009
链接:http://www.novell.com/linux/security/advisories/2002_009_openssh_txt.html

来源: MANDRAKE
名称: MDKSA-2002:019
链接:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-019.php

来源: XF
名称: openssh-channel-error(8383)
链接:http://www.iss.net/security_center/static/8383.php

来源: DEBIAN
名称: DSA-119
链接:http://www.debian.org/security/2002/dsa-119

来源: CALDERA
名称: CSSA-2002-012.0
链接:http://www.calderasystems.com/support/security/advisories/CSSA-2002-012.0.txt

来源: BUGTRAQ
名称: 20020328 OpenSSH channel_lookup() off by one exploit
链接:http://online.securityfocus.com/archive/1/264657

来源: HP
名称: HPSBTL0203-029
链接:http://online.securityfocus.com/advisories/3960

来源: BUGTRAQ
名称: 20020310 OpenSSH 2.9.9p2 packages for Immunix 6.2 with latest fix
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=101586991827622&w=2

来源: BUGTRAQ
名称: 20020308 [OpenPKG-SA-2002.002] OpenPKG Security Advisory (openssh)
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=101561384821761&w=2

来源: BUGTRAQ
名称: 20020307 OpenSSH Security Advisory (adv.channelalloc)
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=101553908201861&w=2

来源: BUGTRAQ
名称: 20020307 [PINE-CERT-20020301] OpenSSH off-by-one
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=101552065005254&w=2

来源: CONECTIVA
名称: CLA-2002:467
链接:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000467

来源: VULNWATCH
名称: 20020307 [VulnWatch] [PINE-CERT-20020301] OpenSSH off-by-one
链接:http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0060.html

来源: BUGTRAQ
名称: 20020311 TSLSA-2002-0039 – openssh
链接:http://archives.neohapsis.com/archives/bugtraq/2002-03/0108.html

来源: CALDERA
名称: CSSA-2002-SCO.11
链接:ftp://stage.caldera.com/pub/security/openunix/CSSA-2002-SCO.11/CSSA-2002-SCO.11.txt

来源: CALDERA
名称: CSSA-2002-SCO.10
链接:ftp://stage.caldera.com/pub/security/openserver/CSSA-2002-SCO.10/CSSA-2002-SCO.10.txt

来源: NETBSD
名称: NetBSD-SA2002-004
链接:ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-004.txt.asc

来源: FREEBSD
名称: FreeBSD-SA-02:13
链接:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:13.openssh.asc

© 版权声明
THE END
喜欢就支持一下吧
点赞0 分享