The CERT Coordination Center is warning users about a serious security vulnerability in the OpenSSH (Secure Shell) that could enable a remote attacker to run malicious code or launch a denial of service attack against machines running the popular suite of secure network connectivity tools.
Many of the leading Unix and Linux operating systems ship with OpenSSH and are vulnerable to attack. In addition, an unknown number of hardware devices such as network routers and switches use the popular package and will need to be patched, according to Dan Ingevaldson, engineering manager of Internet Security Systems Inc.’s (ISS’s) X-Force security group.
OpenSSH is a common tool used by network administrators to remotely communicate with hardware devices, replacing earlier communications tools like telnet and rlogin (remote login) that sent communications back and forth in an unencrypted form.
The exploitable flaw is in the buffer management function of OpenSSH software prior to version 3.7 and could make it possible for remote attackers to cause a buffer overflow on vulnerable machines, according to a CERT advisory.
Attackers would need to modify certain OpenSSH parameters and send extra large SSH data packets, perhaps larger than 10MB, to vulnerable machines to create the buffer overflow, Ingevaldson said.
ISS recently discovered the problem itself and was researching it internally, he said.
However, the company’s work was preempted by others on the Internet who had also discovered the flaw and began discussing it on public security news groups. That prompted ISS to issue its warning and contact the OpenBSD project, which manages OpenSSH, about the problem, Ingevaldson said.
Ingevaldson does not believe that ISS staff are responsible for leaking news about the OpenSSH security hole.
Despite rumours on security discussion lists about code that can exploit the OpenSSH vulnerability, ISS has not developed and does not know of any software code that takes advantage of the new flaw, Ingevaldson said.
Nevertheless, the popularity of OpenSSH makes the vulnerability attractive to malicious hackers and worth paying attention to, he said. Because the suite of tools is an open-source product and available free on the Internet, there is no easy way to determine how many or which products use it, he said.
“For all the positive things that happen with open source software, it does make it trickier to track down who’s using it,” Ingevaldson said. “Nobody has a list of which devices or software have OpenSSH installed.”
The OpenBSD project issued a security alert for OpenSSH and a new version, 3.7.1, on Tuesday and encouraged companies using affected versions of the suite to upgrade to the latest version or apply a software patch. (See www.openssh.com/txt/buffer.adv.)