From owner-ssh@clinet.fi  Fri Jul  3 19:24:12 1998
Received: from lohi.clinet.fi (majordom@lohi.clinet.fi [194.100.0.7]) by hutcs.cs.hut.fi (8.8.8/8.8.8) with ESMTP id TAA00131; Fri, 3 Jul 1998 19:24:12 +0300 (EET DST)
Received: (from majordom@localhost)
	by lohi.clinet.fi (8.9.0/8.9.0) id TAA16579
	for ssh-outgoing; Fri, 3 Jul 1998 19:17:56 +0300 (EEST)
X-Authentication-Warning: lohi.clinet.fi: majordom set sender to owner-ssh@clinet.fi using -f
Received: from squig.sfx.com (squig.sfx.com [169.207.160.17])
	by lohi.clinet.fi (8.9.0/8.9.0) with ESMTP id TAA16569
	for <ssh@clinet.fi>; Fri, 3 Jul 1998 19:17:52 +0300 (EEST)
Received: (from nrh@localhost)
	by squig.sfx.com (8.9.0/3.6.1) id LAA19389;
	Fri, 3 Jul 1998 11:14:53 -0500 (CDT)
Message-ID: <19980703111453.A18506@execpc.com>
Date: Fri, 3 Jul 1998 11:14:53 -0500
From: nicholas harteau <nrh@sfx.com>
To: Andy Polyakov <appro@fy.chalmers.se>, ssh@clinet.fi
Subject: Re: Sun libnsl lameness
References: <199807031409.QAA10780@fysparc9.fy.chalmers.se>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 0.91.1i
In-Reply-To: <199807031409.QAA10780@fysparc9.fy.chalmers.se>; from Andy Polyakov on Fri, Jul 03, 1998 at 04:09:42PM +0200
Sender: owner-ssh@clinet.fi
Precedence: bulk


it was bad form for me to not contact the ssh team before mailing
bugtraq.  at the time it seemed unimportant to notify the ssh team about
a problem that was so directly attributable to the OS vendor.

in retrospect, i realize i should have contacted you directly, my
apologies.


Andy Polyakov wrote:
> I'm the one who is responsible for these calls:-) Hello, everybody!
> 
> First of all I want to point out that mentioned functions in both ssh
> *and* sshd cases are called at least at caller's, a.k.a.  none-root,
> effective uid. Observe that when called at none-root euid 'getnetname'
> does *not* call 'host2netname', but 'user2netname'. In addition it
> should be mentioned that in ssh case call to 'getnetname' is performed
> in separate process context at *both* effective & real caller's uid. So
> that the way I see it it's *not* possible to exploit 'getnetname' to
> gain root privileges in neither ssh nor sshd case.
> 
> Now let's look at 'getsecretkey' in sshd... First of all it looks like
> the information provided in RSI bulletin is not accurate. 'getkeys_nis'
> looks quite innocent to me, but not 'getkeys_nisplus'... I don't
> believe buffer overflow in 'getkeys_nisplus' ever takes place in sshd
> case, because arguments can not be manipulated by the intruder (as he's
> not logged in yet!) by e.g. setting NIS_PATH environment variable. Bad
> news is that all 'getkeys_*' call 'extract_secret' which in turn
> does look like "come and get me"...  But what would it take to exploit
> it? The way I see it intruder would have to have access to or forge
> answers from NIS/NIS+ server in order to feed the victim with unusually
> long key-pairs. Well, I have to conclude that 'getsecretkey' in sshd is
> exploitable. Again! Provided that intruder has access to or capable
> of imitating NIS/NIS+ server.
> 
> Should I think of a patch, people? The only thing one can do is to
> fetch key-pair before calling 'getsecretkey' and make sure it's not
> longer than 1K or something:-)
>
> Andy.

-- 
nicholas harteau
nrh@sfx.com