SSH server 0-day exploit

http://isc.sans.org/diary.html?storyid=6742

by sucuri2 • 17 years ago

95 60 17 years ago

isc.sans.org

sucuri24• 17 years ago

Some info here:

http://secer.org/hacktools/0day-openssh-remote-exploit.html

est• 17 years ago

from here http://baoz.net/0day-openssh-remote-exploit/

palsecam5• 17 years ago

First, it is only a rumour for now.

Second, it would apparently only concerns old versions of OpenSSH. Quoting the link: "It is against an older version of OpenSSH" (OpenSSH_4.3).

martinp• 17 years ago

What they mean by "older version" isn't specified anywhere. It could mean not current for all we know, e.g. < 5.2 (unlikely though). Almost none of the popular distros use the latest version, will be interesting to see which ones are affected.

palsecam5• 17 years ago

For the version information, I quote http://secer.org/hacktools/0day-openssh-remote-exploit.html.

The submitted link seems to copy/paste most of its content from this article, but it didn't include the version information.

mcav• 17 years ago

If it's fixed in the latest OpenSSH, it's not a 0-day exploit, is it?

sucuri24• 17 years ago

Technically it is a 0-day exploit (not published and unknown) but that only works on older versions of SSH.

However, the default version on RHEL, Fedora are vulnerable. So, it is a big issue if there is no patch from your distribution (unless you use ssh from source which is not common).

jacquesm3• 17 years ago

If this is real it's a biggie, there are hundreds of thousands of machines running openssh 4.3.

better check those firewall settings.

lil_cain• 17 years ago

Depends how much older. Does it affect debian/ubuntu/redhat current systems, with fixes backported? It's a pretty big deal if it does.

jacquesm3• 17 years ago

SSH: SSH-2.0-OpenSSH_4.3

The newest releases use 5.1

palsecam5• 17 years ago

Yes, the latest Debian stable release (5.0 "Lenny") uses SSH 5.1.

  $ cat /etc/debian_version
  5.0.2
  $ ssh -v
  OpenSSH_5.1p1 Debian-5, OpenSSL 0.9.8g 19 Oct 2007

sucuri24• 17 years ago

No one knows yet. But the versions included on RHEL, Fedora, etc are all old (no one is on 5.3). So we have to wait and see...

jacquesm3• 17 years ago

The current debian etch ssh package is 4.3p2

andreyf• 17 years ago

Newest ubuntu uses 5.1p1

SSH-2.0-OpenSSH_5.1p1 Debian-5ubuntu1

palsecam5• 17 years ago

And it seems the latest LTS version (Ubuntu 8.04 "Hardy") uses 4.7.

mattyb• 17 years ago

  $ lsb_release -d
  Description: Ubuntu 9.04
  $ ssh -v
  OpenSSH_5.1p1 Debian-5ubuntu1, OpenSSL 0.9.8g 19 Oct 2007

timmaah• 17 years ago

Question along these lines. What version should an updated RHEL4 server have?

I'm only at OpenSSH_3.9p1 yet up2date says everything is up to date.

palsecam5• 17 years ago

Google seems to agree with it.

SwellJoe• 17 years ago

So, just in case anyone is confused about RHEL packaging policy: The version stays the same for the life of the release; patches are applied to that version to fix security and stability issues.

Our forums see tons of questions about this, with folks assuming that because they have an "old" version of PHP or Apache or whatever, that it has known security vulnerabilities. When, in reality, an RHEL released package is probably at least as well-vetted for security as the latest release from upstream.

But, in this case, since there is no known exploit (and it is possibly fictional), there's nothing vendors can possibly do about the problem. I suppose vendors could have been quietly notified of the problem, and we'd start seeing new releases rolling out; but you'd see errata on the relevant vendors website. Asking random folks on HN wouldn't be the best course of action for reliable answers.

Anyway, OpenSSH.org has nothing on the subject.

bsaunder• 17 years ago

The latest release is 5.2.

dryicerx• 17 years ago

For the time being, would be also a good idea to move the ssh port to something other than 22 to avoid getting carpet-bombed by automated exploiting scripts.

mariorz2• 17 years ago

Probably better to use a port knocker. I recommend fwknop.

deutronium2• 17 years ago

Or possibly set up port knocking, may be overkill though

tlrobinson• 17 years ago

Is port knocking a common defense these days? I remember reading about it awhile ago, and thought it was a neat idea but didn't really think people would actually use it.

lanaer2• 17 years ago

That is always a good idea, anyway. Been a long while since I’ve used the standard ssh port on servers under my control.

buugs• 17 years ago

I don't understand why people don't do this it is so much harder if not impossible for people to break into your server by normal means especially when you add MaxAuthTries 3

chez17• 17 years ago

>members of the anti-sec movement.

Can someone tell me what the anti-sec movement is?

henning2• 17 years ago

Sounds like a bunch of script kiddies with a little more brains than usual and just as much malice.

mahmud4• 17 years ago

Antisec are hackers who don't wanna profit from fear.

mahmud4• 17 years ago

Antisec are hackers who don't wanna profit from fear.

sucuri24• 17 years ago

kiddies with brains and technical knowledge to actually write their own exploits are not script kiddies... This term is used for kiddies without brains that just learned to run a few scripts to attack others.

Just clarifying the term.

utnick• 17 years ago

I haven't been interested in computer security in quite a few years so some of this might be out of date:

It is a loose movement that kind of fights against the traditional for-profit computer security industry. they think that publicizing security holes and those hole's exploits causes more pain than it helps. They also seem to be kind of anti-capitalist. A bunch of docs have been written about their goals and ideas. They aren't really script kiddies, some of them are very talented security researchers.

google around for the el8 magazine, also 'phrack high council' or just antisec in general

dtf• 17 years ago

Anti-secs want to keep security - in particular, exploits - private. Milw0rm is their nemesis. There's a discernible political bent to their writings and rantings. While we see a general shift on the internet towards the idea that "information just wants to be free", the anti-sec people don't agree with this when it comes to matters of security. From a white-hat POV, they're saying that full disclosure actually causes more damage than if only a select few, capable, and not necessarily malevolent, people were to know about any particular exploit. But I also get the impression there's a tad of immaturity and insecurity in there. There's revulsion that a once (deservedly) elite occupation has been encroached by larger, more clueless corporations (eg the antivirus mongers, but there are many others), and that the movement is more a rebellion against that than a completely well thought out, idealistic point of view. Still, from recent events, nobody could deny their abilities.

soundsop• 17 years ago

Could the exploit actually be on newer versions of ssh? If so, this could be an attempt to get people to upgrade so that more machines can be compromised.

randallsquared• 17 years ago

What are the chances that the exploit is actually in 5.x, and the "anti-sec movement" is doing some social engineering to get people to upgrade to the affected versions?

aarongough• 17 years ago

My thoughts exactly... If I had an exploit that only worked on the latest versions and I wanted to make use of it I would likely try a scheme like this.

Of course if this is the case then the exploit is likely to be used aggressively sometime in the near future...

skwaddar• 17 years ago

The monoculture has an invader, adapt or die.

tedunangst2• 17 years ago

Original source: http://marc.info/?l=full-disclosure&m=124669956508903...

jlangenauer2• 17 years ago

I just had a browse through my auth.log, and there does seem to be a new sort of automated attack script in the wild - it opens a connection to SSH port 22, (through some spoofed IP address), but then disconnects before attempting to login. That way, it won't show up as an unsuccessful login attempt for any log-monitoring tools which add its IP address to hosts.deny.

However, after it's done that repeatedly (presumably doing some sort of sniffing to work out exactly which version of sshd is running), it then attempts to login. Here's the interesting bit: when it tries to login with a user than doesn't exist, instead of just generating the

  "Invalid user test from xx.xx.xx.xx" log entry,

sshd also outputs another log entry, directly afterwards:

  "input_userauth_request: invalid user test"

which I haven't seen before. I'm not particularly au fait with the internals of sshd, but I would suspect that this new (well, if it is new) script has found an exploit in the part of SSHD which (logically) checks if a user exists first, but the login is being rejected deeper in sshd, when it tries to do the actual authentication.

(All the above is speculation, however: I'm no expert on SSH)

there• 17 years ago

i suspect you are just not looking at the right file (auth log vs. a daemon log) and are only looking at the authentication requests that get passed down to your authentication library (pam?).

tedunangst2• 17 years ago

If the IP is spoofed, how are your reply packets getting back to it?

jlangenauer2• 17 years ago

Spoofed is probably the wrong word - through an irrelevant IP address is a better way to put it(perhaps someone's compromised computer on a botnet acting as a proxy).

miracle• 17 years ago

If it's true, then it's time to migrate the applications to windows servers. First the private/public key fiasko with debian, and then this...

Erwin• 17 years ago

Your sshd is probably configured with tcp wrappers (My RHEL4/5 were). If you only log in from a known set of static IPs, you could add in /etc/hosts.deny:

     sshd: IP1 IP2 .domain.com

The .domain.com allows any IP which reverses to .domain.com.

I ran:

      grep Accepted /var/log/secure*|grep ssh2|perl -lne '/for (\S+) from (\S+)/ && print "$1 $2"'|sort -u

To find all IPs/users that logged in.

This may give you trouble if you SSH from e.g. some mobile connection or from random wifis around the world.

SSH server 0-day exploit

Related Stories