Re: Incorrect protocol implementation by OpenSSH?

On Thu, 27 Sep 2007 22:04:07 +0000, Unruh wrote:

"H.K. Kingston-Smith" <HKK-S@xxxxxxxxx> writes:

I am testing against an embedded SSH server that does not allow
clients to execute commands other than through an interactive shell.
That is, when the server receives an SSH_MSG_CHANNEL_REQUEST message to
execute commands, the server replies with SSH_MSG_CHANNEL_FAILURE. The
issue that I am encountering is that OpenSSH (at least version 4.1 does)
sends an SSH_MSG_UNIMPLEMENTED message in reply.

Why? I can't believe that OpenSSH does not implement
SSH_MSG_CHANNEL_FAILURE message processing - this message is most
certainly contemplated in the standard. It is true that the
SSH_MSG_CHANNEL_REQUEST message sent by the OpenSSH client contains a 0
byte in the want-reply field. However, my interpretation of the relevant
portion of the standard (RFC 4254, section 5.4) is that the server
should send an SSH_MSG_CHANNEL_FAILURE message in this case regardless
of the contents of the want-reply field.

Well, I think "not implimented " and "failure" are different concept.
The second says "Yes, what you tried to send me is fine, but somewhere I
screwed up and the command failed" The first says" You are not supposed
to be trying what you just tried." Your situation seems closer to this
than to the "I screwed up" situation.

My contention is that the server is acting correctly, whereas the
OpenSSH client is not.


Is this not the correct interpretation? The PuTTY client (at
least version 0.60) does seem to agree, for it just terminates the
connection at that point without sending any SSH_MSG_UNIMPLEMENTED
messages.

?? I do not understand. Putty is the client. It is the one requesting
the service, not delivering it.

I think that you have misunderstood what I wrote. The server
sends SSH_MSG_CHANNEL_FAILURE because, like I said, it can't execute
single command lines. When receiving this from the server, an OpenSSH
client replies with SSH_MSG_UNIMPLEMENTED. My question is, Why is it
replying with that?

According to the standard (RFC 4253, section 11.4) I believe that
this message should be sent when a message has been received that has not
been recognized. Does this mean that OpenSSH can't recognize an
SSH_MSG_CHANNEL_FAILURE message? Unlikely. It's more like it wasn't
expecting it. If the former is true, OpenSSH is surprisingly incomplete;
if the latter is true, I believe that it is not acting in agreement with
the standard. This is the clarification I am asking for.

As far as PuTTY is concerned, on receiving
SSH_MSG_CHANNEL_FAILURE, the PuTTY client immediately closes the
connection, printing out a diagnostic for the user to the effect that the
server refuses to execute the command sent. That is, it recognizes the
SSH_MSG_CHANNEL_FAILURE message and proceeds somewhat drastically but, in
my opinion, and unlike OpenSSH, in agreement with the standard.

Clarifications are welcome.


.

Relevant Pages

  • [REVS] Backdoor Spotcom Analysis
    ... Spotcom is a backdoor client application that allows a hacker to control ... The server IP address is hard-coded in ... msrsvp.exe accepts a couple of command line arguments. ... the packet payload. ...
    (Securiteam)
  • [Full-disclosure] Multiple vulnerabilities in Toribash 2.71
    ... C] client unicode buffer-overflow in the SAY command ... D] server crash through uninitialized values ...
    (Full-Disclosure)
  • Multiple vulnerabilities in Toribash 2.71
    ... C] client unicode buffer-overflow in the SAY command ... D] server crash through uninitialized values ...
    (Bugtraq)
  • [1/3] POHMELFS high performance network filesystem. Documentation.
    ... +POHMELFS: Parallel Optimized Host Message Exchange Layered File System. ... * Fast and scalable multithreaded userspace server. ... * Client is able to switch between different servers (if one goes down, ... +command (or set of commands, which is frequently used during data writing: ...
    (Linux-Kernel)
  • [2/3] POHMELFS: Documentation.
    ... * Client is able to switch between different servers (if one goes down, ... Each transaction contains all information needed to process given command ... are asynchronous and are sent to the server during system writeback. ... +POHEMLFS is capable of full data channel encryption and/or strong crypto hashing. ...
    (Linux-Kernel)