There is a remote integer overflow vulnerability in several implementations of the SSH1 protocol that allows an attacker to execute arbitrary code with the privileges of the SSH daemon, typically root.
There is a remote integer overflow vulnerability in several implementations of the SSH1 protocol. This vulnerability is located in a segment of code that was introduced to defend against exploitation of CRC32 weaknesses in the SSH1 protocol (see VU#13877). The attack detection function (detect_attack, located in deattack.c) makes use of a dynamically allocated hash table to store connection information that is then examined to detect and respond to CRC32 attacks. By sending a crafted SSH1 packet to an affected host, an attacker can cause the SSH daemon to create a hash table with a size of zero. When the detection function then attempts to hash values into the null-sized hash table, these values can be used to modify the return address of the function call, thus causing the program to execute arbitrary code with the privileges of the SSH daemon, typically root.
This vulnerability allows a remote attacker to execute arbitrary code with the privileges of the SSH daemon, typically root.
Apply a patch from your vendor
Several vendors of SSH1 implementations have released patches to address this vulnerability; please see the vendor section of this document for further details.
Disable support for SSH protocol version 1
SSH Communications Security
Cisco Systems Inc.
This vulnerability was discovered by Michal Zalewski of the BindView RAZOR Team. The CERT/CC thanks both the BindView RAZOR Team and CORE-SDI for their respective analyses of this vulnerability.
This document was written by Jeffrey P. Lanza.