CERT^® Advisory CA-2001-35 Recent Activity Against Secure Shell Daemons

A complete revision history can be found at the end of this file.

Systems Affected

There are multiple vulnerabilities in several implementations of the Secure Shell (SSH) protocol. The SSH protocol enables a secure communications channel from a client to a server. We are seeing a high amount of scanning for SSH daemons, and we are receiving reports of exploitation. System administrators should review their configurations to ensure that they have applied all relevant patches prior to the holiday break.

I. Description

The following vulnerability note and incident note describe activity regarding the SSH CRC32 attack detection code integer overflow vulnerability.

VU#945216 - SSH CRC32 attack detection code contains remote integer overflow

There is a remote integer overflow vulnerability in several implementations of the SSH1 protocol. This vulnerability is located in a segment of code that was introduced to defend against exploitation of CRC32 weaknesses in the SSH1 protocol (see VU#13877). The attack detection function (detect_attack, located in deattack.c) makes use of a dynamically allocated hash table to store connection information that is then examined to detect and respond to CRC32 attacks. By sending a crafted SSH1 packet to an affected host, an attacker can cause the SSH daemon to create a hash table with a size of zero. When the detection function then attempts to hash values into the null-sized hash table, these values can be used to modify the return address of the function call, thus causing the program to execute arbitrary code with the privileges of the SSH daemon, typically root.

IN-2001-12 - Exploitation of vulnerability in SSH1 CRC-32 compensation attack detector

In reports received by the CERT/CC, systems compromised via this vulnerablity have exhibited the following pattern in system log messages:

hostname sshd[xxx]: Disconnecting: Corrupted check bytes on input.
hostname sshd[xxx]: Disconnecting: crc32 compensation attack: network attack detected
hostname sshd[xxx]: Disconnecting: crc32 compensation attack: network attack detected
...

Some exploits for this vulnerability appear to use a brute force method, so many messages of this type may be logged before a system is successfully compromised.

The following artifacts have been discovered on systems that were successfully compromised:

• Installation of rootkits that modify standard system utilities to hide the intruder's actions
• Installation of Trojan horse versions of the SSH software, compiled from the latest OpenSSH source code plus intruder-supplied modifications
• Installation of tools to scan large network blocks for other systems that are vulnerable to compromise. Log files left behind from these tools indicate that they operate by looking for the banner displayed upon connection to the sshd service.

For a list of vulnerability notes related to SSH vulnerabilities, please see the References section.

II. Impact

The CRC32 attack detection code integer overflow vulnerability, as well as some of the vulnerabilities listed in the References section, can be exploited remotely. In some cases, they allow an intruder to execute arbitrary code with the privileges of the SSH application daemon, usually root. In some cases, an intruder must be an authorized user of the system.

For specific information about the impacts of each of these vulnerabilities, please consult the CERT Vulnerability Notes Database (http://www.kb.cert.org/vuls).

Current versions for Data Fellows (F-Secure) can be found at http://www.f-secure.com/products/ssh/.

Current versions for SSH Communications Security can be found at http://www.ssh.com/products/ssh/download.cfm.

Current versions for OpenSSH can be found at http://www.openssh.com.

Please visit your vendor's web site for the latest version.

Apply a patch from your vendor

Appendix A contains information provided by vendors for this advisory. As vendors report new information to the CERT/CC, we will update this section and note the changes in our revision history. If a particular vendor is not listed below, we have not received their comments for the advisory. Please review the CERT Vulnerability Notes Database (http://www.kb.cert.org/vuls) or contact your vendor directly.

Restrict access to the SSH service

As a general practice, we recommend disabling all services that are not explicitly required. You may wish to disable the SSH access if there is not a patch available from your vendor.

If you cannot disable the service, you can limit your exposure to these vulnerabilities by using a router or firewall to restrict access to port 22/TCP (SSH). Use tcp wrappers or a program that provides similar functionality, or use the key-based IP restriction offered by your implementation. Note that this does not protect you against attackers from within your network.

Appendix A. - Vendor Information

This appendix contains information provided by vendors for this advisory. As vendors report new information to the CERT/CC, we will update this section and note the changes in our revision history. If a particular vendor is not listed below, we have not received their comments for the advisory. Please review the CERT Vulnerability Notes Database (http://www.kb.cert.org/vuls) or contact your vendor directly.

Fujitsu's UXP/V operating system is not affected by the SSH security vulnerabilities because it does not support the SSH package.

Hewlett-Packard Company

This issue does not apply to HP-UX. HP does not ship SSH.

IBM Corporation

This site contains Linux Affinity applications containing cryptographic algorithms, and new users of this site are asked to register first.

NetBSD

Up to date NetBSD security information on SSH, and other vulnerabilities is available from http://www.netbsd.org/Security/

OpenSSH

The CRC32 problem has been fixed in the November 2000 release of OpenSSH 2.3.0.

Sun Microsystems

Feedback on this document can be directed to the authors, Jason A. Rafail and Chad Dougherty

CERT/CC Contact Information

Email: cert@cert.org
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
Postal address:

CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
U.S.A.

CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends.

Using encryption

We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from

http://www.cert.org/CERT_PGP.key

If you prefer to use DES, please call the CERT hotline for more information.

Getting security information

CERT publications and other security information are available from our web site

http://www.cert.org/

* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office.

NO WARRANTY
Any material furnished by Carnegie Mellon University and the Software Engineering Institute is furnished on an "as is" basis. Carnegie Mellon University makes no warranties of any kind, either expressed or implied as to any matter including, but not limited to, warranty of fitness for a particular purpose or merchantability, exclusivity or results obtained from use of the material. Carnegie Mellon University does not make any warranty of any kind with respect to freedom from patent, trademark, or copyright infringement.

Copyright 2001 Carnegie Mellon University.

Revision History

December 13, 2001:  Initial release
December 14, 2001:  Added OpenSSH Vendor Statement