search menu icon-carat-right cmu-wordmark

CERT Coordination Center

SSH CRC32 attack detection code contains remote integer overflow

Vulnerability Note VU#945216

Original Release Date: 2001-10-24 | Last Revised: 2003-05-20

Overview

There is a remote integer overflow vulnerability in several implementations of the SSH1 protocol that allows an attacker to execute arbitrary code with the privileges of the SSH daemon, typically root.

Description

There is a remote integer overflow vulnerability in several implementations of the SSH1 protocol. This vulnerability is located in a segment of code that was introduced to defend against exploitation of CRC32 weaknesses in the SSH1 protocol (see VU#13877). The attack detection function (detect_attack, located in deattack.c) makes use of a dynamically allocated hash table to store connection information that is then examined to detect and respond to CRC32 attacks. By sending a crafted SSH1 packet to an affected host, an attacker can cause the SSH daemon to create a hash table with a size of zero. When the detection function then attempts to hash values into the null-sized hash table, these values can be used to modify the return address of the function call, thus causing the program to execute arbitrary code with the privileges of the SSH daemon, typically root.

Impact

This vulnerability allows a remote attacker to execute arbitrary code with the privileges of the SSH daemon, typically root.

Solution

Apply a patch from your vendor

Several vendors of SSH1 implementations have released patches to address this vulnerability; please see the vendor section of this document for further details.

Disable support for SSH protocol version 1


On vulnerable SSH1 servers where patches are either unavailable or cannot be installed, the CERT/CC recommends that system administrators disable SSH1 service until a more permanent solution can be found. To determine whether a given SSH server is vulnerable, please consult the vendor section of this document.

Vendor Information

945216
 

CVSS Metrics

Group Score Vector
Base
Temporal
Environmental

References

Acknowledgements

This vulnerability was discovered by Michal Zalewski of the BindView RAZOR Team. The CERT/CC thanks both the BindView RAZOR Team and CORE-SDI for their respective analyses of this vulnerability.

This document was written by Jeffrey P. Lanza.

Other Information

CVE IDs: CVE-2001-0144
CERT Advisory: CA-2001-35
Severity Metric: 99.00
Date Public: 2001-02-08
Date First Published: 2001-10-24
Date Last Updated: 2003-05-20 00:24 UTC
Document Revision: 51

Sponsored by CISA.