[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <dee4adeb-e6b5-b011-b1cc-7c8e76a3ed1f@redhat.com>
Date: Thu, 20 Oct 2016 08:39:40 +0530
From: Huzaifa Sidhpurwala <huzaifas@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Re: CVE Request: OpenSSH: Memory exhaustion issue
found in OpenSSH
On 10/20/2016 03:02 AM, cve-assign@...re.org wrote:
>> The OpenSSH has a memory exhaustion bug in key exchange process. An
>> unauthenticated peer could repeat the KEXINIT and cause allocation of
>> up to 384MB(not 128MB that the official said). In the default case, an
>> attacker can build 100 such connections, which will consume 38400 MB
>> of memory on the server.
>
>> http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/kex.c?rev=1.127&content-type=text/x-cvsweb-markup
>
>>> Unregister the KEXINIT handler after message has been received.
>
> Use CVE-2016-8858.
>
>
OpenSSH upstream dos not consider this as a security issue btw.
It seems the only thing the attacker could do here, is self-dos his own
connection. Regarding consuming memory on the server, by opening several
concurrent connections at the same time, there are various protections
available in opensshd_config file, such as "MaxStartups", which can
limit the maximum number of sessions per network connections.
This value is effectively set to 10:30:100 so maximum of 100 * 128 MB
can be allocated, which is pretty much for unauthenticated user. Though
the rate limiting starts to drop connection after 10, which is like 1GB
and which should not hurt the server (though it is not cool).
--
Huzaifa Sidhpurwala / Red Hat Product Security Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
