Vulnerability Note VU#945216

SSH CRC32 attack detection code contains remote integer overflow

Overview

There is a remote integer overflow vulnerability in several implementations of the SSH1 protocol that allows an attacker to execute arbitrary code with the privileges of the SSH daemon, typically root.

I. Description

There is a remote integer overflow vulnerability in several implementations of the SSH1 protocol. This vulnerability is located in a segment of code that was introduced to defend against exploitation of CRC32 weaknesses in the SSH1 protocol (see VU#13877). The attack detection function (detect_attack, located in deattack.c) makes use of a dynamically allocated hash table to store connection information that is then examined to detect and respond to CRC32 attacks. By sending a crafted SSH1 packet to an affected host, an attacker can cause the SSH daemon to create a hash table with a size of zero. When the detection function then attempts to hash values into the null-sized hash table, these values can be used to modify the return address of the function call, thus causing the program to execute arbitrary code with the privileges of the SSH daemon, typically root.

II. Impact

This vulnerability allows a remote attacker to execute arbitrary code with the privileges of the SSH daemon, typically root.

III. Solution

Apply a patch from your vendor

Several vendors of SSH1 implementations have released patches to address this vulnerability; please see the Systems Affected section of this document for further details.

Disable support for SSH protocol version 1

On vulnerable SSH1 servers where patches are either unavailable or cannot be installed, the CERT/CC recommends that system administrators disable SSH1 service until a more permanent solution can be found. To determine whether a given SSH server is vulnerable, please consult the Systems Affected section of this document.

Systems Affected

Vendor	Status	Date Updated
SSH Communications Security	Vulnerable	6-Nov-2001
OpenSSH	Vulnerable	10-Dec-2001
FreeBSD	Vulnerable	13-Dec-2001
CORE SDI	Vulnerable	13-Dec-2001
Debian	Vulnerable	13-Dec-2001
Cisco	Not Vulnerable	13-Dec-2001
SuSE	Vulnerable	13-Dec-2001

References

VU#13877
http://razor.bindview.com/publish/advisories/adv_ssh1crc.html
http://www.cert.org/advisories/CA-2001-35.html
http://www.core-sdi.com/pressroom/advisories_desplegado.php?idx=81&idxsection=10#
http://www.f-secure.com/support/ssh/
http://www.kb.cert.org/vuls/id/13877
http://www.openssh.com/security.html
http://www.para-protect.com/Advisories/Guests/2001/20010627_1540_ORVEA01.pdf
http://www.securityfocus.com/bid/2347
http://www.ssh.com/products/ssh/advisories/ssh1_crc-32.cfm
http://xforce.iss.net/static/6083.php
http://xforce.iss.net/alerts/advise100.php

Credit

This vulnerability was discovered by Michal Zalewski of the BindView RAZOR Team. The CERT/CC thanks both the BindView RAZOR Team and CORE-SDI for their respective analyses of this vulnerability.

This document was written by Jeffrey P. Lanza.

Other Information

Date Public	02/08/2001
Date First Published	10/24/2001 07:44:25 PM
Date Last Updated	12/13/2001
CERT Advisory	CA-2001-35
CVE Name	CVE-2001-0144
Metric	99.00
Document Revision	48

If you have feedback, comments, or additional information about this vulnerability, please send us email.