Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 8 Oct 2014 11:07:59 +0200
From: Hanno Böck <>
To: OSS Security List <>
Subject: openssh on linux rce in sftp-only mode

This seems CVE-worthy:

"OpenSSH lets you grant SFTP access to users without allowing full
command execution using "ForceCommand internal-sftp". However, if you
misconfigure the server and don't use ChrootDirectory, the user will be
able to access all parts of the filesystem that he has access to -
including procfs. On modern Linux kernels (>=2.6.39, I
think), /proc/self/maps reveals the memory layout and /proc/self/mem
lets you write to arbitrary memory positions. Combine those and you get
easy RCE."

It involves a number of issues coming together, however in the end it
is an RCE with a legit configuration.

 * sftp-server(8): On platforms that support it, use prctl() to
   prevent sftp-server from accessing /proc/self/{mem,maps}

Hanno Böck


Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.