{"id":106630,"date":"2023-02-03T12:48:25","date_gmt":"2023-02-03T10:48:25","guid":{"rendered":"https:\/\/prohoster.info\/?p=106630"},"modified":"2023-02-03T21:50:37","modified_gmt":"2023-02-03T19:50:37","slug":"vypusk-openssh-9-2-s-ustraneniem-uyazvimosti-proyavlyayushhejsya-na-etape-do-autentifikaczii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-openssh-9-2-s-ustraneniem-uyazvimosti-proyavlyayushhejsya-na-etape-do-autentifikaczii","title":{"rendered":"Release of OpenSSH 9.2 addressing a vulnerability that manifests before authentication","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The release of OpenSSH 9.2 has been announced, an open-source implementation of the client and server for SSH 2.0 and SFTP protocols. This new version fixes a vulnerability that leads to double freeing of memory before authentication is complete. Only OpenSSH 9.1 is affected; earlier versions do not exhibit this issue. <\/p>\n
To create conditions for the vulnerability to manifest, it is sufficient to change the SSH client's banner to 'SSH-2.0-FuTTYSH_9.1p1' in order to trigger the flags 'SSH_BUG_CURVE25519PAD' and 'SSH_OLD_DHGEX', which depend on the version of the SSH client. After these flags are set, the memory for the buffer 'options.kex_algorithms' is freed twice \u2014 during the execution of the function do_ssh2_kex(), which calls compat_kex_proposal(), and during the execution of the function do_authentication2(), which successively calls input_userauth_request(), mm_getpwnamallow(), copy_set_server_options(), assemble_algorithms(), and kex_assemble_names(). <\/p>\n
Creating a working exploit for the vulnerability is considered unlikely, as the exploitation process is overly complicated \u2014 modern memory allocation libraries provide protection against double memory freeing, and the pre-auth process, in which the error exists, runs with reduced privileges in an isolated sandbox environment. <\/p>\n
In addition to the noted vulnerability, this release also addresses two more security issues: <\/p>\n
\n
An error in handling the 'PermitRemoteOpen' setting leads to the first argument being ignored if it differs from the values 'any' and 'none'. The issue manifests in versions newer than OpenSSH 8.7 and results in skipping the check when specifying only one privilege.\n
An attacker controlling the DNS server used for name resolution can achieve the substitution of special characters (for example, '*') in the known_hosts files if the settings CanonicalizeHostname and CanonicalizePermittedCNAMEs are enabled in the configuration and the system resolver does not validate the responses from the DNS server. Conducting the attack is considered unlikely, as the returned names must match the conditions set through CanonicalizePermittedCNAMEs. <\/ul>\n
Other changes: <\/p>\n
\n
The ssh_config for ssh has added the setting EnableEscapeCommandline, which controls the enabling of processing the escape sequence '~C' on the client side, providing a command line. By default, processing of '~C' is now disabled to utilize a stricter sandbox isolation, which could potentially disrupt the operation of systems where '~C' is used for port redirection during operation.\n
In sshd_config for sshd, the ChannelTimeout directive has been added to specify the inactivity timeout for channels (channels that have no recorded traffic during the time specified in the directive will be automatically closed). Different timeouts can be set for the session, X11, agent, and traffic redirection.\n
In sshd_config for sshd, the UnusedConnectionTimeout directive has been added, allowing the setting of a timeout for terminating client connections that remain inactive for a specified period without active channels.\n
An option '-V' has been added to sshd for displaying the version, similar to the corresponding option in the ssh client.\n
The output of 'ssh -G' has been augmented with the line 'Host', reflecting the value of the argument with the hostname.\n
In scp and sftp, the option «-X» has been added to control SFTP protocol parameters such as copy buffer size and the number of pending requests.\n
In ssh-keyscan, scanning of complete CIDR address ranges is allowed, for example, «ssh-keyscan 192.168.0.0\/24». <\/ul>\n