OpenSSH Developers Patch Vulnerability

A vulnerability in a popular, free implementation of the Secure Shell protocols that prompted a warning from the suites developers was quickly capped last week.

The vulnerability in OpenSSH Versions 2.9.9 through 3.3, which allow local and remote root compromise, resulted from an input validation error that enabled an integer overflow and privilege escalation, according to developers. OpenSSH encrypts all traffic, including passwords, to thwart eavesdropping, connection hijacking and other attacks.

The free set of network connectivity tools was developed by the OpenBSD Project and is frequently used in place of Telnet, rlogin and FTP access. It comes bundled with OpenBSD and a number of other Unix operating systems, including Solaris 9.

The vulnerability was disclosed on the OpenSSH Web site, with a warning that users should enable privilege separation features and prepare to upgrade to OpenSSH 3.4 this week. The security threat was detailed the following morning by Internet Security Systems Inc. researchers, who discovered the hole, prompting an early release of the new SSH suite.

According to the advisory from ISS, in Atlanta, the weakness exists within the ChallengeResponseAuthentication mechanism in the OpenSSH daemon, or sshd.

If upgrading to OpenSSH 3.4 is not an option, users are advised to disable the ChallengeResponseAuthentication option or enable the UsePrivilegeSeparation option (only available in OpenSSH 3.2 or later) in the tools sshd_ config configuration file.

“We believe we have the information contained. It is, after all, in 27,000 lines of code,” developer Theo de Raadt, founder of the OpenBSD and OpenSSH projects, told eWeek.”If it does leak out or a parallel discovery of it happens, we will be ready with an immediate patch,” said de Raadt, in Calgary, Alberta.

In addition to OpenBSD and FreeBSD, OpenSSH works with dozens of operating systems, including most flavors of Linux, NetBSD, Computone, Stallion, Mac OS X Version 10.1, HP Procurve Switch 4108GL and 2524/2512, and AIX.

• More Security Coverage