Re: [VulnWatch] exploiting the zlib bug in openssh

From: Michal Zalewski (lcamtuf@coredump.cx)
Date: 03/12/02 

Date: Tue, 12 Mar 2002 12:12:51 -0500 (EST)
From: Michal Zalewski <lcamtuf@coredump.cx>
To: H D Moore <sflist@digitaloffense.net>

On Tue, 12 Mar 2002, H D Moore wrote:

> I patched the OpenSSH client to send this corrupt zlib buffer after the
> key exchange, the inflate() call on the remote end is returning the
> correct value indicating that the buffer did what it was supposed to
> (Z_MEM_ERR or -4), but the remote daemon is NOT crashing during the
> fatal_cleanup() and inflateEnd() calls. Taking the same buffer and
> sticking it into the inflate() call of another application causes the
> desired SEGV and possible path to exploitability, so why isn't OpenSSH
> crashing?

I think I researached this problem few months ago. I found this condition
while performing fuzz-alike test on zlib, thinking specifically about one
of SSH implementations. The problem with exploiting it in OpenSSH checks
are strict enough to exit almost immediately, after first inflate() call
returns error - while the bug needed second inflate() call or inflateEnd()
call to be exploited (don't remember extactly). One way or another, I
found this not exploitable and gave up on this bug. 

-- 
_____________________________________________________
Michal Zalewski [lcamtuf@bos.bindview.com] [security]
[http://lcamtuf.coredump.cx] <=-=> bash$ :(){ :|:&};:
=-=> Did you know that clones never use mirrors? <=-=
          http://lcamtuf.coredump.cx/photo/

Relevant Pages

  • exploiting the zlib bug in openssh
    ... A bug was found in the zlib compression library which causes inflateEndto ... the buffer it passes to inflate(). ... obtain the buffer the OpenSSH client needs to send. ...
    (Bugtraq)
  • Re: [GIT-PULL] More Squashfs fixes for 2.6.29?
    ... This situation was incorrectly flagged as an output buffer ... inflate() always flushes as much output as ... I think you _should_ be doing an inner loop over zlib_inflatethat just does inflates until you get a buffer error, and if you get a buffer error you then go on to the next page if avail_out is zero, or fill the input buffer if it's empty. ...
    (Linux-Kernel)
  • Re: zlib flush modes
    ... Yes, the nine bits of lookahead assures that, but sometimes you can ... when inflate gets to the end of the provided input for that ... call, and can't fill the buffer to at least nine bits, it will drop ... in the table to try to decode the next code. ...
    (comp.compression)
Quantcast