The release of OpenSSH 9.3 has been published, an open implementation of the client and server for SSH 2.0 and SFTP protocols. The new version addresses security issues:
- A logical error was identified in the ssh-add utility, which prevented restrictions set using the 'ssh-add -h' option from being passed to the ssh-agent when adding keys for smart cards. As a result, a key was added to the agent without applying the restrictions that allow connections only from specific hosts.
- A vulnerability in the ssh utility was discovered that could lead to reading data from the stack area outside the allocated buffer when processing specially crafted DNS responses, provided that the VerifyHostKeyDNS setting is enabled in the configuration file. The issue exists in the built-in implementation of the getrrsetbyname() function, which is used in portable versions of OpenSSH built without the external ldns library (—with-ldns) and on systems with standard libraries that do not support the getrrsetbyname() call. The possibility of exploiting this vulnerability, aside from initiating a denial of service attack on the ssh client, is considered unlikely.
Additionally, there is a vulnerability in the libskey library included with OpenBSD, which is used in OpenSSH. This problem has existed since 1997 and may lead to a stack buffer overflow when processing specially formatted host names. It is noted that although the manifestation of the vulnerability can be initiated remotely through OpenSSH, in practice it is ineffective, as to trigger it, the target host's name (/etc/hostname) must contain more than 126 characters, and the buffer can only be overflowed with null characters ('\0').
Among the non-security-related changes:
- Support for the '-Ohashalg=sha1|sha256' parameter has been added in ssh-keygen and ssh-keyscan to select the hashing algorithm for SSHFP fingerprints.
- An option '-G' has been added in sshd for parsing and displaying the active configuration without attempting to load private keys and without performing additional checks, allowing configuration verification at the stage before key generation and enabling checks by non-privileged users.
- In sshd, isolation has been strengthened on the Linux platform using system call filtering mechanisms seccomp and seccomp-bpf. Flags for mmap, madvise, and futex have been added to the list of allowed system calls.
Source: opennet.ru
