Vulnerability Note VU#945216

SSH CRC32 attack detection code contains remote integer overflow

Original Release date: 24 Oct 2001 | Last revised: 19 May 2003

Overview

There is a remote integer overflow vulnerability in several implementations of the SSH1 protocol that allows an attacker to execute arbitrary code with the privileges of the SSH daemon, typically root.

Description

There is a remote integer overflow vulnerability in several implementations of the SSH1 protocol. This vulnerability is located in a segment of code that was introduced to defend against exploitation of CRC32 weaknesses in the SSH1 protocol (see VU#13877). The attack detection function (detect_attack, located in deattack.c) makes use of a dynamically allocated hash table to store connection information that is then examined to detect and respond to CRC32 attacks. By sending a crafted SSH1 packet to an affected host, an attacker can cause the SSH daemon to create a hash table with a size of zero. When the detection function then attempts to hash values into the null-sized hash table, these values can be used to modify the return address of the function call, thus causing the program to execute arbitrary code with the privileges of the SSH daemon, typically root.

Impact

This vulnerability allows a remote attacker to execute arbitrary code with the privileges of the SSH daemon, typically root.

Solution

Apply a patch from your vendor

Several vendors of SSH1 implementations have released patches to address this vulnerability; please see the vendor section of this document for further details.

Disable support for SSH protocol version 1


On vulnerable SSH1 servers where patches are either unavailable or cannot be installed, the CERT/CC recommends that system administrators disable SSH1 service until a more permanent solution can be found. To determine whether a given SSH server is vulnerable, please consult the vendor section of this document.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
CORE SDIAffected08 Feb 200113 Dec 2001
DebianAffected08 Feb 200113 Dec 2001
FreeBSDAffected12 Feb 200113 Dec 2001
OpenSSHAffected06 Nov 200010 Dec 2001
SmoothWallAffected-14 Dec 2001
SSH Communications SecurityAffected-06 Nov 2001
SuSE Inc.Affected-13 Dec 2001
Cisco Systems Inc.Not Affected31 Oct 200113 Dec 2001
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

This vulnerability was discovered by Michal Zalewski of the BindView RAZOR Team. The CERT/CC thanks both the BindView RAZOR Team and CORE-SDI for their respective analyses of this vulnerability.

This document was written by Jeffrey P. Lanza.

Other Information

  • CVE IDs: CVE-2001-0144
  • CERT Advisory: CA-2001-35
  • Date Public: 08 Feb 2001
  • Date First Published: 24 Oct 2001
  • Date Last Updated: 19 May 2003
  • Severity Metric: 99.00
  • Document Revision: 51

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.