Lucene search

K
freebsdFreeBSD6A308E8E-B1B4-11DA-B2FB-000E0C2E438A
HistoryMar 01, 2006 - 12:00 a.m.

openssh -- remote denial of service

2006-03-0100:00:00
vuxml.freebsd.org
15

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.045 Low

EPSS

Percentile

92.3%

Problem description:
Because OpenSSH and OpenPAM have conflicting designs (one is event-
driven while the other is callback-driven), it is necessary for
OpenSSH to fork a child process to handle calls to the PAM framework.
However, if the unprivileged child terminates while PAM authentication
is under way, the parent process incorrectly believes that the PAM
child also terminated. The parent process then terminates, and the
PAM child is left behind.
Due to the way OpenSSH performs internal accounting, these orphaned
PAM children are counted as pending connections by the master OpenSSH
server process. Once a certain number of orphans has accumulated, the
master decides that it is overloaded and stops accepting client
connections.
Impact:
By repeatedly connecting to a vulnerable server, waiting for
a password prompt, and closing the connection, an attacker can
cause OpenSSH to stop accepting client connections until the
system restarts or an administrator manually kills the orphaned
PAM processes.
Workaround:
The following command will show a list of orphaned PAM
processes:

pgrep -lf ‘sshd.*[pam]’

The following command will kill orphaned PAM processes:

pkill -f ‘sshd.*[pam]’

To prevent OpenSSH from leaving orphaned PAM processes behind,
perform one of the following:

Disable PAM authentication in OpenSSH. Users will still
be able to log in using their Unix password, OPIE or SSH
keys.
To do this, execute the following commands as root:

echo ‘UsePAM no’ >>/etc/ssh/sshd_config

echo ‘PasswordAuthentication yes’ >>/etc/ssh/sshd_config

/etc/rc.d/sshd restart

If disabling PAM is not an option - if, for instance, you use
RADIUS authentication, or store user passwords in an SQL database
- you may instead disable privilege separation. However, this may
leave OpenSSH vulnerable to hitherto unknown bugs, and should be
considered a last resort.
To do this, execute the following commands as root:

echo ‘UsePrivilegeSeparation no’ >>/etc/ssh/sshd_config

/etc/rc.d/sshd restart

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchfreebsd= 5.4UNKNOWN
FreeBSDanynoarchfreebsd< 5.4_12UNKNOWN

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.045 Low

EPSS

Percentile

92.3%

Related for 6A308E8E-B1B4-11DA-B2FB-000E0C2E438A