Fwd: OpenSSH Buffer Management Bug Advisory

[Martin `MJ' Mares]

Hello, world!\n

Toto security advisory asi stoji za forwardovani do konference...

Ve zkratce: v OpenSSH je pomerne zavazny bug v buffer managementu.
Exploit jsem jeste nevidel, ale je dost mozne, ze se brzy objevi.
Debian i RH uz maji opravene package, ostatni distribuce jsem zatim
nesledoval.

Patchum zdar :)

					M.M.


----- Forwarded message from Dave Ahmad <da na securityfocus.com> -----

Date: Tue, 16 Sep 2003 10:27:37 -0600 (MDT)
From: Dave Ahmad <da na securityfocus.com>
To: bugtraq na securityfocus.com
Subject: OpenSSH Buffer Management Bug Advisory
X-Spam-Status: No, hits=-100.3 required=5.0
	tests=KNOWN_MAILING_LIST,PATCH_UNIFIED_DIFF,RCVD_IN_ORBS,
	      RCVD_IN_OSIRUSOFT_COM,USER_AGENT_PINE,USER_IN_WHITELIST
	version=2.55


The following advisory is listed on the OpenSSH security page.  It was up
some time ago before disappearing for a while and then reappearing in the
last few minutes.

---

Subject: OpenSSH Security Advisory: buffer.adv

This is the 1st revision of the Advisory.

This document can be found at:  http://www.openssh.com/txt/buffer.adv

1. Versions affected:

        All versions of OpenSSH's sshd prior to 3.7 contain a buffer
        management error.  It is uncertain whether this error is
        potentially exploitable, however, we prefer to see bugs
        fixed proactively.

2. Solution:

	Upgrade to OpenSSH 3.7 or apply the following patch.

Appendix:

Index: buffer.c
===================================================================
RCS file: /cvs/src/usr.bin/ssh/buffer.c,v
retrieving revision 1.16
retrieving revision 1.17
diff -u -r1.16 -r1.17
--- buffer.c	26 Jun 2002 08:54:18 -0000	1.16
+++ buffer.c	16 Sep 2003 03:03:47 -0000	1.17
@@ -69,6 +69,7 @@
 void *
 buffer_append_space(Buffer *buffer, u_int len)
 {
+	u_int newlen;
 	void *p;

 	if (len > 0x100000)
@@ -98,11 +99,13 @@
 		goto restart;
 	}
 	/* Increase the size of the buffer and retry. */
-	buffer->alloc += len + 32768;
-	if (buffer->alloc > 0xa00000)
+
+	newlen = buffer->alloc + len + 32768;
+	if (newlen > 0xa00000)
 		fatal("buffer_append_space: alloc %u not supported",
-		    buffer->alloc);
-	buffer->buf = xrealloc(buffer->buf, buffer->alloc);
+		    newlen);
+	buffer->buf = xrealloc(buffer->buf, newlen);
+	buffer->alloc = newlen;
 	goto restart;
 	/* NOTREACHED */
 }


David Mirza Ahmad
Symantec

PGP: 0x26005712
8D 9A B1 33 82 3D B3 D0 40 EB  AB F0 1E 67 C6 1A 26 00 57 12
--
The battle for the past is for the future.
We must be the winners of the memory war.

----- End forwarded message -----