CERT warns of SSH vulnerability

IDG News Service - The CERT Coordination Center at Carnegie Mellon University in Pittsburgh is warning users about a serious security vulnerability in the OpenSSH (Secure Shell) that could enable a remote attacker to run malicious code or launch a denial-of-service attack against machines running the popular suite of secure network connectivity tools.
Many of the leading Unix and Linux operating systems ship with OpenSSH and are vulnerable to attack. In addition, an unknown number of hardware devices, including network routers and switches, use the popular package and will need to be patched, according to Dan Ingevaldson, engineering manager of the X-Force security group at Internet Security Systems Inc. (ISS).
OpenSSH is a common tool used by network administrators to remotely communicate with hardware devices, replacing earlier communications tools like Telnet and rlogin (remote log-in) that sent communications back and forth in an unencrypted form.
The exploitable flaw, which is in the buffer management function of OpenSSH software prior to Version 3.7, could make it possible for remote attackers to cause a buffer overflow on vulnerable machines, according to a CERT advisory.
Attackers would need to modify certain OpenSSH parameters and send extra-large SSH data packets, perhaps larger than 10MB, to vulnerable machines to create the buffer overflow, Ingevaldson said.
ISS recently discovered the problem itself and was researching it internally, he said.
However, the company's work was preempted by others on the Internet who had also discovered the flaw and began discussing it on public security news groups. That prompted ISS to issue a warning and contact the OpenBSD project, which manages OpenSSH, about the problem, Ingevaldson said.
Ingevaldson doesn't believe that ISS staff are responsible for leaking news about the OpenSSH security hole.
Despite rumors on security discussion lists about code that can exploit the OpenSSH vulnerability, ISS hasn't developed and doesn't know of any software code that takes advantage of the new flaw, Ingevaldson said. Nevertheless, the popularity of OpenSSH makes the flaw attractive to malicious hackers and worth paying attention to, he said. Because the suite of tools is an open-source product and available free on the Internet, there is no easy way to determine how many or which products use it.
"For all the positive things that happen with open-source software, it does make it trickier to track down who's using it," Ingevaldson said. "Nobody has a list of which devices or software have OpenSSH installed."
The OpenBSD project yesterday issued a security alert for OpenSSH and a new version, 3.7.1, and encouraged companies using affected versions of the suite to upgrade to the latest version or apply a software patch.