Vulnerability Note VU#978316

Vulnerability in OpenSSH daemon (sshd)

There are two methods a client can use to authenticate to an SSH server. The first method is password authentication. This method is generally the easiest to set up, but the least secure. As long as the client has a valid username and password, they can gain access to the system running the SSH server. The second method is public key authentication. Public key authentication is one of the most secure methods available to authenticate a user. For a client to gain access to a system using public key authentication, a copy of the client's public key must exist on the SSH server. The client must also have the private key in their possession as well as the passphrase associated with the private key.

In addition to the methods available to authenticate a user, there also exists ways in which one can restrict access to the SSH server, such that connections are permitted only from trusted hosts. One of the most common methods is by utilizing a firewall to do host-based access restriction. Additionally, sshd has the ability to restrict access by IP address or hostname. While this is not cryptographically strong security, it provides an additional layer of protection which some sites rely upon to limit their exposure.

A flaw exists in the way OpenSSH evaluates IP addresses and hostnames. We have included an excerpt of the report sent to BugTraq regarding this vulnerability:

Interestingly, when a purely numeric IP address is provided, an attacker who controls reverse DNS for his host can circumvent this controls by returning text containing a numeric IP address in the reverse DNS response. This would allow stolen keys containing numeric IP address restrictions to be used from other IP address, or external access to a system which had

AllowUsers *@192.168.*.*

set in an attempt to limit access to users in the internal 192.168/16 network.

The exploit works because the code treats both the IP address and hostname as strings, and there is no logic to indicate when a pure IP address match should be attempted.

Systems Affected

http://www.securityfocus.com/archive/1/324016/2003-06-03/2003-06-09/0
ftp://ftp.porcupine.org/pub/security/tcp_wrappers_7.6.tar.gz
http://www.ietf.org/html.charters/secsh-charter.html
http://www.openssh.com/
http://www.iss.net/security_center/static/12196.php

Credit

This vulnerability was discovered by Mike Harding. Note that this behavior of OpenSSH was in fact noticed and published two years earlier by Richard Silverman and Dan Barrett in "SSH, The Secure Shell: The Definitive Guide" (O'Reilly 2001, ISBN 0-596-00011-1). See section 5.5.2.1, p179 in the first edition.

This document was written by Ian A Finlay.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.