OpenSSH SFTP Remote Overflow Vulnerability

OpenSSH SFTP Remote Overflow Vulnerability

Jann Horn, a security community enthusiast, announced that OpenSSH allows users with SFTP access to use the "ForceCommand internal-sftp" Vulnerability (including POC) without verification ), that is to say, if "ChrootDirectory" is not configured in your OpenSSH server, normal users can access all the file system resources, including/proc, on the Linux kernel> = 2.6.x, /proc/self/maps will display your memory layout./proc/self/mem allows you to read and write any data in the context of the current process. Combining the two features can cause remote overflow, currently, the affected version is <= OpenSSH 6.6, and OpenSSH 6.7 contains a solution to reduce risks: sftp-server uses prctl () to prevent direct access to/proc/self/{mem, maps }. Grsecurity/PaX directly disables/proc/pid/mem writability. Therefore, if Grsecurity/PaX is deployed in your production environment, you do not need to worry about this vulnerability.

Provides FTP + SSL/TLS authentication through OpenSSL and implements secure data transmission.

Analysis of encryption algorithms and OpenSSL for OpenSSH

Install and configure OpenSSH in Ubuntu Server 13.10

Install OpenSSH remotely on Ubuntu

Solve the latency problem during remote login through OpenSSH

Offline installation of OpenSSH in Ubuntu 12.10

OpenSSH upgrade steps and precautions

Solutions for failures of common OpenSSH users

General thread: OpenSSH key management, Part 1 Understanding RSA/DSA authentication

Install OpenSSH and configure the sftp lock directory for RedHat

OpenSSL details: click here
OpenSSL: click here

This article permanently updates the link address: