Vulnerability Note VU#814198

SSH Tectia Server contains a race condition when the password change plugin is enabled

Overview

SSH Tectia Server contains a race condition that may permit an authenticated user access to the private key of the server. Exploitation of this vulnerability may lead to the ability to compromise the trust relationships of the vulnerable server.

I. Description

SSH Tectia Server versions 4.0.3 and 4.0.4 for Unix contain a race condition vulnerability when the password change plugin (ssh-passwd-plugin) is enabled. Note that the password change plugin is disabled by default. Versions 4.0.3 and 4.0.4 of SSH Tectia Server running on the following platforms are affected:

Redhat Linux 7.3, 8.0, 9.0 - Intel i686
IBM AIX 4.3, 5.1, 5.2 Power PC - RS/6000
Sun Solaris 2.5.1, 2.6, 7, 8, 9 - SPARC
HP/Compaq HP-UX 10.20, 11.0, 11.11 (11i) - PA-RISC

If a host has been running a vulnerable version of SSH Tectia, configured to use the password change plugin and the users have had shell access, SSH recommends that the hostkeys be regenerated after upgrading.

II. Impact

Exploitation of this vulnerability may lead to the ability of an authenticated user with shell access to gain access to the private key of the server, thus compromising the trust relationships of the vulnerable server.

III. Solution

Upgrading to 4.0.5. If a host has been running a vulnerable version of SSH Tectia, configured to use the password change plugin and the users have had shell access, SSH recommends that the hostkeys be regenerated after upgrading.

Disabling the AuthPassword.ChangePlugin configuration option will mitigate this vulnerability.

Systems Affected

Vendor	Status	Date Notified	Date Updated
SSH Communications Security	Vulnerable	23-Mar-2004

References

http://www.ssh.com/company/newsroom/article/520/
http://www.ssh.com/support/downloads/tectia-server-unix/

Credit

Thanks to SSH Communications for reporting this vulnerability.

This document was written by Jason A Rafail and is based on the information provided by SSH Communications.

Other Information

Date Public:	2003-03-23
Date First Published:	2004-03-23
Date Last Updated:	2004-03-23
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	11.39
Document Revision:	17

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader