Re: OpenSSL Vulnerability and OpenSSH

From: Markus Friedl (markus@openbsd.org)
Date: 09/23/02 

Date: Mon, 23 Sep 2002 10:33:41 +0200
From: Markus Friedl <markus@openbsd.org>
To: nestler@speakeasy.net

On Sat, Sep 21, 2002 at 09:43:48AM -0700, nestler@speakeasy.net wrote:
> I see a call to d2i_X509() in scard-opensc.c. This function
> uses the ASN.1 parser. I also see a call to PEM_read_PrivateKey()
> in authfile.c. That function also uses the ASN.1 parser.
> That last one gets used in a few different places in the SSH code (indirectly
> via key_load_private*()).

yes, but that's a completely different problem.

> Are you sure that none of these are problems? The SSH client
> is installed setuid root in some places and it would load potentially
> malicious private keys during the course of public key authentication without
> an agent. It seems like that could be a problem (at least a local problem).

the ssh client should not be installed setuid root with 3.4p1.

if installed setuid root, then the ssh client should drop privilegues
before loading the private user keys.

Relevant Pages

  • Re: Password security
    ... > one that uses keys AND passwds. ... sniffing or a trojaned ssh client. ... otherwise someone could trojan your OPIE calculator and snarf your ...
    (FreeBSD-Security)
  • Re: MORE SSH Hacking: heads-up
    ... > claimed that it was possible to guess which keys a user presses by ... why doesn't/can't the ssh client simply not send any of the password until ... the user presses Enter, thereby defeating this attack against an initial ... the connection is established, the connection is encrypted, so it seems ...
    (Fedora)
  • Re: sshd known_hosts query
    ... It stores keys for each server to which I connect and validates that it's the same one as last time (re-installing a server causes its keys to change, ... I'm seeking to restrict access to sshd. ... This works like you describe and automatically collects the keys for the hosts you connect to with your ssh client. ...
    (uk.comp.os.linux)
  • Re: [OT] ssh client
    ... >I've searched the net for a ssh client for the M$ ... >platform that provides ssh_2_ support and uses ... You may want to try SecureCRT by vandyke.. ... get my keys to get access to the rest of my boxes.. ...
    (FreeBSD-Security)