|
Brought to you by:
Suppliers of:
|
|
|
| |
| When the UseLogin option is enabled the OpenSSH server (sshd) does not switch to the uid of the user logging in, but relies on login(1) to do the job instead. However, if the user specifies a command for remote execution login(1) cannot be used and sshd fails to set the correct user id. The result is that the command is executed with the same privilege as sshd (usually with root) and basically enables users to obtain root privileges. |
| |
Credit:
The information has been provided by: Markus Friedl.
|
| |
Vulnerable systems:
OpenSSH prior to 2.1.1 with the UseLogin option enabled.
Immune systems:
The default installation of OpenSSH is not vulnerable.
If the administrator of an OpenSSH daemon enables UseLogin, users can get privileged access to the server running sshd.
Workaround:
Do not enable UseLogin on your machines or disable UseLogin again in /etc/sshd_config:
UseLogin no
Patch:
Upgrade to OpenSSH-2.1.1 or apply the attached patch. OpenSSH-2.1.1 is available from http://www.openssh.com.
Code Patch:
OpenSSH-1.2.2
--- sshd.c.orig Thu Jan 20 18:58:39 2000
+++ sshd.c Tue Jun 6 10:12:00 2000
@@ -2231,6 +2231,10 @@
struct stat st;
char *argv[10];
+ /* login(1) is only called if we execute the login shell */
+ if (options.use_login && command != NULL)
+ options.use_login = 0;
+
f = fopen("/etc/nologin", "r");
if (f) {
/* /etc/nologin exists. Print its contents and exit. */
OpenSSH-1.2.3
--- sshd.c.orig Mon Mar 6 22:11:17 2000
+++ sshd.c Tue Jun 6 10:14:07 2000
@@ -2250,6 +2250,10 @@
struct stat st;
char *argv[10];
+ /* login(1) is only called if we execute the login shell */
+ if (options.use_login && command != NULL)
+ options.use_login = 0;
+
f = fopen("/etc/nologin", "r");
if (f) {
/* /etc/nologin exists. Print its contents and exit. */
OpenSSH-2.1.0
--- session.c.orig Wed May 3 20:03:07 2000
+++ session.c Tue Jun 6 10:10:50 2000
@@ -744,6 +744,10 @@
struct stat st;
char *argv[10];
+ /* login(1) is only called if we execute the login shell */
+ if (options.use_login && command != NULL)
+ options.use_login = 0;
+
f = fopen("/etc/nologin", "r");
if (f) {
/* /etc/nologin exists. Print its contents and exit. */
EOF
|
|
|
|
|
