SuSE: openssh Buffer management vulnerability
Summary
______________________________________________________________________________
SuSE Security Announcement
Package: openssh
Announcement-ID: SuSE-SA:2003:038
Date: Tuesday, Sep 16 2003 22:15 MEST
Affected products: 7.2, 7.3, 8.0, 8.1, 8.2
SuSE Linux Database Server,
SuSE eMail Server III, 3.1
SuSE Linux Enterprise Server 7, 8
SuSE Linux Firewall on CD/Admin host
SuSE Linux Connectivity Server
SuSE Linux Office Server
SuSE Linux Standard Server 8
Vulnerability Type: potential remote privilege escalation
Severity (1-10): 8
SuSE default package: yes
Cross References: openssh
CERT VU#333628
CVE CAN-2003-0693
Content of this advisory:
1) security vulnerability resolved: openssh
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds:
- mysql
3) standard appendix (further information)
______________________________________________________________________________
1) problem description, brief discussion, solution, upgrade information
The openssh package is the most widely used implementation of the secure
shell protocol family (ssh). It provides a set of network connectivity
tools for remote (shell) login, designed to substitute the traditional
BSD-style r-protocols (rsh, rlogin). openssh has various authentification
mechanisms and many other features such as TCP connection and X11 display
forwarding over the fully encrypted network connection as well as file
transfer facilities.
A programming error has been found in code responsible for buffer
management. If exploited by a (remote) attacker, the error may lead to
unauthorized access to the system, allowing the execution of arbitrary
commands.
The error is known as the buffer_append_space()-bug and is assigned the
Common Vulnerabilities and Exposures (CVE) name CAN-2003-0693.
At the time of writing this announcement, it is unclear if the
buffer_append_space()-bug is exploitable. However, an increasing amount
of TCP connection attempts to port 22 (the ssh default port) has been
observed in the internet during the past days, which may indicate that
there exists an exploit for the error.
Please note that we have disabled the Privilege Separation feature in
the ssh daemon (sshd) with this update. The PrivSep feature is designed
to have parts of the ssh daemon's work running under lowered privileges,
thereby limiting the effect of a possible vulnerability in the code. The
PrivSep feature is turned on/off by the UsePrivilegeSeparation keyword
in sshd's configuration file /etc/ssh/sshd_config. The feature is held
responsible for malfunctions in PAM (Pluggable Authentification Modules).
The update mechanism will not overwrite configuration files that have
been altered after the package installation.
SPECIAL INSTALL INSTRUCTIONS:
============================= After the update has been successfully applied, the ssh daemon (sshd)
must be restarted for update package to become effective. To restart the
ssh daemon after the update, please run the following command as root:
rcsshd restart
Please download the update package for your distribution and verify its
integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command "rpm -Fhv file.rpm" to apply
the update.
Our maintenance customers are being notified individually. The packages
are being offered to install from the maintenance web.
Intel i386 Platform:
SuSE-8.2:
492d66deaedcfc20c1f0d66e508db790
patch rpm(s):
c362fedfda79824cb40cd4e5e1055aee
source rpm(s):
0381b9b4818f8b669631bcab9be80fb5
SuSE-8.1:
dda7728501c8cf17c60eff1862922842
patch rpm(s):
d02dfc049413b725c4255887487cfa67
source rpm(s):
26dd44e9bed7a5ad2d35e56301dc5489
SuSE-8.0:
2361dccd5b0c83178f8d0d5988b3490e
patch rpm(s):
5bef6aff5a603e3376a2f907c494ea7e
source rpm(s):
203aab39cdb7c5672a82bb07bc4a1f38
SuSE-7.3:
1418135ed33e59d1ce37ea135617b5bc
source rpm(s):
9d0b789127d30cca9f45c7b1f2268673
SuSE-7.2:
e807ecd9c4d167e3ef3764c06af1a511
source rpm(s):
a99aa03ba94f45dd25054b1ab1a962d7
Sparc Platform:
SuSE-7.3:
e4f9b7e8763464d60761faf94b7f80f9
source rpm(s):
ca0cbe5b564b03c64458868db369c4de
PPC Power PC Platform:
SuSE-7.3:
0166ec0aec482b687bc2891611ae8ae9
source rpm(s):
aed7879361a85f263a1cb3a00de964a1
______________________________________________________________________________
2) Pending vulnerabilities in SuSE Distributions and Workarounds:
- A buffer overflow vulnerability has been found in the mysql package,
an Open Source relational database system. The error may allow a remote
attacker to execute arbitrary code with the privileges of the database
process.
We are in the process of building and testing the update packages and
will release them with a SuSE Security Announcement as soon as possible.
______________________________________________________________________________
3) standard appendix: authenticity verification, additional information
- Package authenticity verification:
SuSE update packages are available on many mirror ftp servers all over
the world. While this service is being considered valuable and important
to the free and open source software community, many users wish to be
sure about the origin of the package and its content before installing
the package. There are two verification methods that can be used
independently from each other to prove the authenticity of a downloaded
file or rpm package:
1) md5sums as provided in the (cryptographically signed) announcement.
2) using the internal gpg signatures of the rpm package.
1) execute the command
md5sum
References
