Slashdot Mirror
New Vulnerabilities in Portable OpenSSH
An anonymous reader writes "The OpenSSH team has uncovered multiple exploitable vulnerabilities in the days-old portable release of OpenSSH. That's right folks: time to patch *again*. 3.7.1p2 is now available. Instructions and mirror list here. Please note that this vulnerability only affects *portable* OpenSSH--so if you are running OpenBSD, you're safe. This vulnerability apparently has to do with PAM, so you can use the 'UsePam no' option in your config file. Info on the advisory here and here."
From the article: At least one of these bugs is remotely exploitable (under a non-standard configuration, with privsep disabled)
Priviledge Separation saves the day again. I think this is a testament to the forward thinking of the OpenBSD and OpenSSH people: they know that human error introduces potentially exploitable bugs, hence the work that went into PrivSep to minimize the risk.
"The lengths some people will goto to try and damage Theo's pride" Most moronic submitter comment ever.
Trolling is a art,
Who is pam, and what did she have to do with openssh?
-ted
This vulnerability apparently has to do with PAM, so you can use the 'UsePam no' option in your config file.
Wouldn't that prevent anyone from loging-in? I guess that's a solution. Why not disconnect the network cable, too?
Ive just bought A A64-FX with Debian/FX 3.2 today. When can i apt-get the patch?
Maybe the OSS community needs a Trustworthy Computing initiative =]
Portable SSH? is that the version that is portable to OS X or portable to what? What is the difference between portable ssh and not portable?
1. It's bug-riddled .....
2. It's got a girls name
3.
4. Profit!
Or something like that.
... I'll wait for 3.7.2 ...
Ahh, the joys of another afternoon spent patching boxes. I guess it is better than waiting for a vendor to come up with a patched binary package.
Before we all panic, note that PAM is not in the default build.
It's also not in slackware builds (thanks Patrick).
This is getting ridiculous. Maybe it's time for OpenSSH development to completely halt for the moment, and do some serious auditing? This is just plain sad... I know people have been joking about switching to lsh, but at a current "score" of 3 to 1, I'm starting to consider it, at least for the time being... :-/
The Free desktop that Just Works
[anonymous@coward home]$ ssh -V
OpenSSH_3.6.1p2, SSH protocols 1.5/2.0, OpenSSL 0x0090702
Because you can have it notify you and update all these things automatically and not even worry about any of this stuff. It's real simple, too. All you do it check "automatic updates" and it works! Then there are no more problems. No worms. No exploits. Your box is secure. 4m4zin6!
What, you mean the same lsh that was just exploited two days ago?
Frankly, I think you'd have better luck searching the web for 'ssh'.
So how is this different to MS having multiple attempts to resolve their security bugs ? I don't see a difference. Doesn't this prove that closed or OSS, security code is a difficult software engineering challange ? Maybe slashdotters should cut MS some slack in this area.
catch (ModDownException mde) {post.modUp("Interesting")}
what do you wanne patch today?
The RH-supplied latest OpenSSH (3.5p1-11) doesn't seem to accept the "UsePam no" directive that was suggested as a workaround, so if you go ahead and add that line to your /etc/ssh/sshd_config and say "service sshd restart", SSH will complain about an invalid configuration option and refuse to start. Just for your information..
Follow your Euro bills at EBT
More secure?
Advisory
Subject: Portable OpenSSH Security Advisory: sshpam.adv
This document can be found at: http://www.openssh.com/txt/sshpam.adv
1. Versions affected:
Portable OpenSSH versions 3.7p1 and 3.7.1p1 contain multiple
vulnerabilities in the new PAM code. At least one of these bugs
is remotely exploitable (under a non-standard configuration,
with privsep disabled).
The OpenBSD releases of OpenSSH do not contain this code and
are not vulnerable. Older versions of portable OpenSSH are not
vulnerable.
2. Solution:
Upgrade to Portable OpenSSH 3.7.1p2 or disable PAM
support ("UsePam no" in sshd_config).
Due to complexity, inconsistencies in the specification and
differences between vendors' PAM implementations we recommend
that PAM be left disabled in sshd_config unless there is a need
for its use. Sites only using public key or simple password
authentication usually have little need to enable PAM support.
Just to alleviate some of the panic, RedHat boxes are safe.
This vulnerability apparently has to do with PAM
When will people learn that non-stick cooking spray causes more harm than good? Unneeded fat, calories and remote root exploits are just some of the problems caused by these unsavory products. For god's sake, people...there are better ways to dissipate heat and prevent sticking and burning. For one, turn that CPU clock speed down! Just because you can fry an egg on your motherboard, doesn't mean you should! That's what the CD-ROM drive is for!
This vulnerability apparently has to do with PAM,
;)
Yeah, I always blame my problems on the chick too
(kekekeke)
do() || do_not();
Okay, a bunch of posts already, but where are all the "*BSD is dying" trolls now? OpenBSD got it right, but porting to Linux and other OSes screwed up.
OSS should compete with features and security not number of exploits and patches.
On second thought, maybe more patches will make IT managers think that OSS=MS in quality and will begin to use OSS more because it is as good as MS.
NarratorDan
"If you're not confused by quantum mechanics, you really don't understand it." - Niels Bohr
...that OpenBSD is not vulnerable because it doesn't use PAM itself. It uses BSD-auth(imported from BSD/OS I think) as its authentication system.
The advisory says that PAM should be disabled by default. I think that it isn't a very realistic petition. Most of (medium|large)-scale Unix/linux deployments depends on pam modules like pam_ldap, pam_krb, etc...
The directive should be:
"UsePAM no"
Case matters.
X+1 holes in the default install in over 7 years!
Its a joke people.....
Apple just came out with Mac OS X update 10.2.8 which fixed the last OpenSSH exploit. Does anyone know if that updates also covers the new exploit mentioned here? Or should I expect 10.2.9 in a few days?
Strange women lying in ponds distributing swords is no basis for a system of government.
Only 2 remote holes in the last 2 weeks.
In light of the recent CERT/CC advisories regarding security vulnerabilities in the Sendmail and OpenSSH programs (even before the problems with new release of portable Open SSH) the Center for Regulatory Effectiveness' WatchDog Watch discussed the need for open source watchdogs. Please see, www.thecre.com/wdw/20030922_open_source.html Winston Security Director, WatchDog Watch
Note: This post is not intended as a troll or flamebait, I'm merely stating my opinion, which is this:
When this kind of thing can happen with such important and widely used open source software, I think people should take a moment to consider being more lenient towards Microsoft and their endless patches.
I'm not saying that MS products are in any way more secure than their OSS equivalents, indeed they are most likely less secure, but we need to remember that theirs are not the only insecure programs in the world. Take heed people.
I'm using pretty much the default config file, and I've never intentionally enabled PAM. Here's what the PAM part looks like:
# Set this to 'yes' to enable PAM authentication (via challenge-response)
# and session processing. Depending on your PAM configuration, this may
# bypass the setting of 'PasswordAuthentication'
#UsePAM yes
If you have to uncomment out that line to enable PAM authentication, then *not* uncommenting it is equivalent to setting it to "no" (like the advisory says to do) yes? The advisory does appear to mention this default, explicitly anyway...
[sorry to ask what may be the obvious, but weeks fall off my probable lifespan whenever I'm messing with sshd on a remote server, and I'd sure like to avoid it if I can]
who's moderating the meta-moderators?
15^H^H10 minutes without a remote root exploit!
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
Is it just me, or is Slashdot totally slow, websitewise and networkwise? Like at least 30 secs for a page to come up after clicking.
oooh! Patching every other day is fun!
This is just like being a MCSE! Now I can hang out with the NT guys and chat about patching!
I'm not trying to be a tool here, but seriously, does anyone ever expect any piece of software to be 100% foolproof? Software is complex, and in its complexity lies opportunity for problems to arise. Sometimes they are simple coding mistakes, sometimes they are problems that arise when the software isn't used as its developers envisioned.
As users of software though, it is irresponsible to assume that just because it is commercial, open source, MS, non-MS, or whoever is the messiah of the day's product that it will never have unexpected problems. Admittedly, some companies software appears to be worse than others, but that is the gamble we take when we build complex systems.
Children in the backseats don't cause accidents. Accidents in the back seats cause children.
Are we sure Microsoft aren't involved in this project in some way?
This patch is coming out before any known implementation of an exploit, and certainly well before worms start using it.
With Microsoft, we wouldn't know of days after the virus makes the news.
This is a prime example of why OSS is beter. It has been fixed before those "evil hacker terrorist communists" find out about it.
You can't judge a book by the way it wears its hair.
Anyone else running into problems building openssh 3.7.1p2?
/etc/ssh/sshd_conf
I got p1 to work ok on Mandrake 8.1 system.
The new version apparently will not allow for keyboard-int authorization. I configured --with-pam and I don't have PAM off in my
I could not even get 3.7.1p1 to compile on an older mandrake box.. Doh. gotta upgrade.
You backspaced twice, but you only needed to replace the 5 with 0, thus only needing to erase one of the characters. Hence:
15^H0 minutes without a remote root exploit!
... oh, wait. You were doing that for illustratory purposes...
I reeealy need to get a life...
The first time I read that I thought I saw SPAM. I blame SPAM for most of my problems now anyway (diet, junk email, etc), so I wasn't too surprised to be adding network security to the list.
Matt Fahrenbacher
James Tiberius Kirk: "Spock, the women on your planet are logical. No other planet in the galaxy can make that claim."
Not so fast!
The LAST vulnerabilities were for 3.6 and 3.7 as well, but 3.4 COULD be vulnerable as it's now 'off the beaten path' and these vulnerabilities seem to have been discovered in a code audit triggered by the recent attention given to OpenSSH. Apple had to patch their 3.4 version, and I'd expect another minor software update package from Apple in the next few days to address this.
Anybody out there know if it's easy to build current versions (3.7.1p2, etc.) of OpenSSH on OS X with the developer tools installed, or is there some very compelling reason Apple is sticking to 3.4 and just adding to it?
"Sometimes, I think Trent just needs a cup of hot chocolate and a blankie." -Tori Amos on Nine Inch Nails
AFAIK, commented code shows the defaults, PAM is PROBABLY ON in your case. Most of us use PAM for authentication, so I wouldn't shrug this off.
"Sometimes, I think Trent just needs a cup of hot chocolate and a blankie." -Tori Amos on Nine Inch Nails
That didn't have a patch out weeks or months before an exploit was seen in the wild?
It's time for a code audit.
Karma: The shiznight, mostly because I am the Drizzle.
http://projects.standblue.net/rpms/openssh/3.7.1p2 /
Enjoy.
Microsoft could learn something from this. The OpenSSH team finds a problem,
announces it, and makes a fix available. Then they identify similar problems,
announce them, and make fixes available.
Microsoft seems to follow one of three different procedures depending on
circumstances:
1. ignore the problem until there's an exploit and public outcry
2. quietly release a fix and then advertise it when there's an exploit and
public outcry
3. leave the problem unfixed in order to force people to upgrade
I say we bash Microsoft until they start designing their products with
security in mind.
*sigh* back to work...
The poster seems to insinuate that patching again is a chore...security is, by very nature, a moving target. I'm *glad* they find vulnerabilities and post regular patches...proves to me, at least, that somebody is on-the-ball.
;-)
Heck, just be thankful they don't belong to the Microsoft school of security and fixes
-psy
I've heard statements like these again and again, and every time I thank the decision I made to use OpenBSD on our firewalls. Their focus on security really does pay dividends. Yes, they still get it wrong from time to time. But they're far ahead of the rest of the field.
"The invisible and the non-existent look very much alike." -- Delos B. McKown
This post is gaurenteed a -1, when going s/debian/microsoft/g would get +5, insightful. Remember to metamod unfair.
Self-fulfilling prophecy, eh? It's already -1...
Try spelling "guaranteed" to get the second part working.
and you sir, are a hell bound heretic!
I have no need for Potable OpenSSH, since I only drink alcohol.
I think that code auditing IS going on, and that's why they're noticing these security holes. This is something that an auditor found - there have not (at least to my knowlege) been any crack ins/compromises due to this.
..........FULL STOP.
These exploits ain't all bad. As an OpenBSD security admin i've never felt so valued! :)
Is it actually on any mirror site yet? I tried five, none of them had the new version.
Do you care about the security of your wireless mouse?
Nimda:
Patch Released: August 15, 2001
Major Exploit Starts: September 18, 2001
SQL Slammer Worm:
Patch Released: July 24, 2002
Major Exploit Starts: January 25, 2003
MS Blaster Worm:
Patch Released: July 16, 2003
Patch Released: August 11, 2003
So, how was this about "ignoring the problem" again?
The patched version is in the Gentoo portage tree already, so it's time to emerge -u world!
I stopped using OpenSSH last year, These problems were hinted in the massive flaws from last year. Sure everything has flaws, but this is like everyday, for something that we're supposed to trust FOR security. Hell, at this rate, running telnetd is more secure. Its less likely you'll be sniffed then get hit by some passing worm within 5 mins of putting a box online.
ssh from ssh.fi is more secure out of the box (no ssh1), requires alot less depedencies on other programs, and is more configurable. Not to mention its the offical version of SSH.
OpenSSH == wuftpd/sendmail of security software, get rid of it. At least for now.
24 hours after release...
damn.
At least we know a patch will come about quick.
Any idea how to find what version of sshd is running? Looking at the man pages on OS X, and all the advisories offers no info on how to simply get the version number out of the binary... Usually a simple sshd --version would work with most things I did manage to find something that is probably the version number on my machine by running strings "/usr/sbin/sshd" and sifting through the output, but it is not ideal...
OpenSSH has grown a little too big to be maintained properly.
Okay, mod me down again...
Frying an Egg on an Athlon XP
Apparently, and I have this on good authority, the reason this bug exists is because the existance of Windows periodically alters the space-time continuum. In other words the oh so perfect Open BSD coders are aiming at a moving target -- what they thought was a solution would have worked in a parallel universe but Gates deliberately altered our
time line in an attempt to discredit the UNIX world. In other words, this is nothing more than Microsoft FUD.
There is nothing new about this vulnerability, it has been there all along, the _discovery_ of it, is however new.
OpenSSH_3.4p1+CAN-2003-0693, SSH protocols 1.5/2.0, OpenSSL 0x0090609f
In the advisory on securityfocus, it says that the affected versions are "Portable OpenSSH versions 3.7p1 and 3.7.1p1" - so it seems that since it's not using the latest, hottest implementation, OS X is not affected.
Of course, I'm only guessing here...
Otherwise this Windows SSH bug would be tearing me up! I mean, really! First Microsoft releases a patch to their buggy SSH implementation, and then the patch opens a new, even BIGGER hole. Those idiots at Microsoft can't get anything right! No wonder open source is so much better!
I feel so safe and secure knowing my Linux software doesn't have bugs like this, and my remote shell software is totally secure against intrusion.
Oh, wait...
I forgot...
This is a Linux bug that was patched and caused another bug! Oh, perish the thought!
So, where are the 748 comments all screaming about how pitiful security is on Linux systems? You know, those same screamers who loudly bitch and moan and jump up and down whenever a Microsoft patch breaks something else?
Dare I smell a little hypocrisy?
Oh, wait...
I forgot...
This is Slasdot, where hypocrisy is considered a virtue.
Lots of patches and OpenSource = GOOD!
Lots of patches and M$ = BAD!
This actually scares me more than recent MS holes because with SSH I'm doing "top-secret hush-hush no-girls-allowed club" stuff and so I really am depending alot on this piece of software.
The surprise isn't how often we make bad choices; the surprise is how seldom they defeat us.
Do you seriously expect an end to buffer overflows while people keep programming in C? That's the issue. Use an unsafe language and you are bound to remain a fool.
If I had a sig, I would put it here.
Doesn't it seem strange that the finding of multiple bugs in the same piece of open source software in a short period of time is stated as a strength of open source while the same thing in Microsoft software is stated as a weakness... Yes, in the open source case they were found by code inspection and in the case of Microsoft they were found by exploit, but a patch a day is still a patch a day. It's not always a good idea to rush patches out as soon as a potential hole is found...
Dr. Rick
- "It's such a fine line between clever and stupid" (Nigel Tufnel)
- Zort! (Pinky)
Ya know, maybe it's time to take the word "Open" out of OpenSSH. It's becoming too much of a self-fulfilling prophecy.
How about "TheSourceIsOpen_ButWeWillBeDamnedIfYouGetInWitho
Last time we has a big OpenSSH rush we got the same thing, when priveledge separation was introduced and updating was the only way to be safe.
OpenBSD was fixed of course, others had (rightly, hmm not always at least) updated to something that was vulnerable. And before that the CRC bug...
I'm not taking this too seriously anymore.
Check out CERT's vunlerability notes to see if you are vulnerable. Most of the major distros of Linux are NOT vulnerable since they backported patches to pre-3.7p1 versions rather than upgrade their users to 3.7p1 or 3.7.1p1.
http://www.kb.cert.org/vuls/id/602204
IBM eServer and Cisco are still listed as unknown.
Actually, it is the lack of software freedom that is bad. You can't understand the value of software freedom unless you look at who may make and distribute the patches and who can not. With proprietary software no matter how talented a hacker you are you can't fully inspect or modify the software installed on your computer.
With free software, how much you can inspect, modify, and share code depends on your situation (often how much time and effort you put into developing code). I wouldn't want to buy a car only one garage could fix, I wouldn't want to be limited to one electrician or plumber for my house. I don't want to be limited to one organization for getting improvements to the software I depend on.
Digital Citizen
They mean the problem has to be with pam, that's the code related to pam, not the pam itself.
You mean the Windows version of putty is still secure and open source isn't? for shame! Go ahead anti MS fascists. Mod me down. If I had said it the other way around it would be +5 informative. I use both and the only reason I still use MS is because the programs I want to run won't run on *nix. They've had years to make it work and haven't yet even in beta. Make Quicken and my games work in *nix and my path to the dark side will be complete.
Two roads diverged in a wood, and I - I took the one the bus load of girls just went down.
To say "you're safe" without qualification is surely tempting fate. I'm pretty sure the crackers out there take more satisfaction in breaking software backed by such arrogant, bullish claims!
"safe wrt this bug" would be more appropriate.
With windowsupdate you at least have a single place to download these patches...
(Woops... there goes my karma!)
+++ATH0
Ahem, I hate to point it out, but the debian stable release of the ssh package isn't even vulnerable. What's wrong with backporting fixes? It seems to be good enough of for Apple and Sun.
As far as I know, 3.7.1p2 was available when all these vulnerabilities were first mentioned a while back. The first thing i downloaded was 3.7.1p2.. So I dont think this is new news.
Also, been having problems with 3.7.1p2 on Solaris 9. Doesnt seem to matter which libwrap i compile against (using configure --with-tcp-wrappers), it seems to have trouble parsing hosts.allow.
example file:
ALL: 127.0.0.1
sshd: 123.231.213.1 123.231.213.2 123.231.213.3
ALL: PARANOID: DENY
ALL: ALL: DENY
ALL: ALL: DENY gets parsed as ALL: ALL and accepts connections from anywhere
Removing that line then denies all connections. making sshd: ALL opens it up to everything again.. sshd: 123.231.213.1 by itself doesnt work, sshd: IP IP IP (list of ips as above) doesnt work... sshd: hostname or sshd: hostname hostname hostname etc doesnt work....
been dealing with this since the release... anybody have this problem?
Why has OpenSSH seemingly become the new WuFTPd? I guess on the bright side it *is* getting more secure now.
in a properly set up mandrake box making sure
the below two lines get run once a day takes care of the problem
urpmi.update update_source
urpmi --update --auto --auto-select
what is the windows equivalent?
set windows update to automatically download and install patches for you
the odds of an automatic update screwings things up are laughably minuscule, compared to leaving your box unpatched