Vulnerability Note VU#945216
SSH CRC32 attack detection code contains remote integer overflow
There is a remote integer overflow vulnerability in several implementations of the SSH1 protocol that allows an attacker to execute arbitrary code with the privileges of the SSH daemon, typically root.
There is a remote integer overflow vulnerability in several implementations of the SSH1 protocol. This vulnerability is located in a segment of code that was introduced to defend against exploitation of CRC32 weaknesses in the SSH1 protocol (see VU#13877). The attack detection function (detect_attack, located in deattack.c) makes use of a dynamically allocated hash table to store connection information that is then examined to detect and respond to CRC32 attacks. By sending a crafted SSH1 packet to an affected host, an attacker can cause the SSH daemon to create a hash table with a size of zero. When the detection function then attempts to hash values into the null-sized hash table, these values can be used to modify the return address of the function call, thus causing the program to execute arbitrary code with the privileges of the SSH daemon, typically root.
This vulnerability allows a remote attacker to execute arbitrary code with the privileges of the SSH daemon, typically root.
Apply a patch from your vendor
Several vendors of SSH1 implementations have released patches to address this vulnerability; please see the vendor section of this document for further details.
Disable support for SSH protocol version 1
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|CORE SDI||Affected||08 Feb 2001||13 Dec 2001|
|Debian||Affected||08 Feb 2001||13 Dec 2001|
|FreeBSD||Affected||12 Feb 2001||13 Dec 2001|
|OpenSSH||Affected||06 Nov 2000||10 Dec 2001|
|SmoothWall||Affected||-||14 Dec 2001|
|SSH Communications Security||Affected||-||06 Nov 2001|
|SuSE Inc.||Affected||-||13 Dec 2001|
|Cisco Systems Inc.||Not Affected||31 Oct 2001||13 Dec 2001|
CVSS Metrics (Learn More)
This vulnerability was discovered by Michal Zalewski of the BindView RAZOR Team. The CERT/CC thanks both the BindView RAZOR Team and CORE-SDI for their respective analyses of this vulnerability.
This document was written by Jeffrey P. Lanza.
- CVE IDs: CVE-2001-0144
- CERT Advisory: CA-2001-35
- Date Public: 08 Feb 2001
- Date First Published: 24 Oct 2001
- Date Last Updated: 19 May 2003
- Severity Metric: 99.00
- Document Revision: 51
If you have feedback, comments, or additional information about this vulnerability, please send us email.