BID 7482, bug in OpenSSH (Still in FreeBSD-STABLE)

From: Felipe Neuwald (felipe.neuwald_at_loreno.com.br)
Date: 04/12/04

  • Next message: IO ERROR: "Citadel/UX 6.20 fixes local permissions vulnerability"
    To: bugtraq@securityfocus.com
    Date: Mon, 12 Apr 2004 09:07:51 -0300
    
    
    

    Hello Folks,

    I tested only versions OpenSSH_3.5p1 (FreeBSD-STABLE), but it also work
    on other versions, as published May 01, 2003.
    Ok, let's talk about it. First, the /etc/ssh/sshd_config file:
    <cut>
    PermitRootLogin no
    <cut>
    As you can see above, is not allowed to root login on that system. Fine.
    Now, trying login as root to the system, and type the wrong password:

    felipe@worm felipe $ ssh -l root host
    Password:
    Password:
    Password:
    root@host's password:
    Permission denied, please try again.
    root@host's password:
    Permission denied, please try again.
    root@host's password:
    Permission denied (publickey,password,keyboard-interactive).

    And now, trying login as root to the system, but typing the correct
    password:

    felipe@worm felipe $ ssh -l root host
    Password:
    Connection to host closed by remote host.
    Connection to host closed.

    It's easy to make one little program to discover with bruteforce the
    correct password of the root login. If the attacker have physical access
    to the system, it's very easy own the system.
    But... why still FreeBSD-STABLE are running this version of OpenSSH?

    -- 
    Felipe Neuwald
    felipe.neuwald@loreno.com.br
    +55 61 3038-5038
    +55 61 9557-6870
    ------
    Chave pública PGP / PGP public key:
    http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x8AE508F3
    
    



  • Next message: IO ERROR: "Citadel/UX 6.20 fixes local permissions vulnerability"