oss-security - CVE request: mysecureshell: local denial of service (or worse)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <51EEBB23.40204@pipping.org>
Date: Tue, 23 Jul 2013 19:19:31 +0200
From: Sebastian Pipping <sebastian@...ping.org>
To: oss-security@...ts.openwall.com
Subject: CVE request: mysecureshell: local denial of service (or worse)

Hello everyone,

mysecureshell [1] is an SFTP-only shell to be used with sshd.

The latest release 1.31 makes use of shared memory with permissions 666
to maintain 128 slots with one struct for each connection/process.
An unprivileged user can mark mark all remaining slots as occupied (and
optionally wait for remaining clients to leave to block those slots, too).

To demonstrate the issue, I have written a small command line tool.
It's free software and can be found at [2].  Use it like this:

  # make
  cc -std=c99 -Wall -Wextra -pedantic local-dos.c -o local-dos

  # ./local-dos
  USAGE:
    ./local-dos (block|unblock|show)

  # watch -n 1 -d ./local-dos block
  [..]

Besides the local DoS it might be possible to attack the call to chdir,
since that is reading from shared memory, too.

Any ideas on other attacks based on writing to that block of shared
memory?  File /bin/MySecureShell is mode 4755 setuid root if that makes
it more interesting :-)

Best,

Sebastian

[1] http://mysecureshell.sourceforge.net/
[2] https://github.com/hartwork/mysecureshell-issues

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.