SSH1守护程序crc32补偿攻击检测安全漏洞

临时解决方法： 如果您不能立刻安装补丁或者升级，CNNVD建议您采取以下措施以降低威胁：

* 如果您正在运行SSH2，并允许兼容SSH1，CNNVD建议您暂时禁止SSH1。

* Michal Zalewski ([email protected])也提供了下列的临时补丁程序：

SSH1 software:

8

--- deattack.c.orig Wed Feb 7 13:53:47 2001

+++ deattack.c Wed Feb 7 13:54:24 2001

@@ -79,7 +79,7 @@

detect_attack(unsigned char *buf, word32 len, unsigned char *IV)

{

static word16 *h = (word16 *) NULL;

- static word16 n = HASH_MINSIZE / HASH_ENTRYSIZE;

+ static word32 n = HASH_MINSIZE / HASH_ENTRYSIZE;

register word32 i, j;

word32 l;

register unsigned char *c;

8

Bjoern Groenvall's ossh (ftp://ftp.pdc.kth.se/pub/krypto/ossh/):

8

--- deattack.c.orig Wed Feb 7 14:11:23 2001

+++ deattack.c Wed Feb 7 14:11:46 2001

@@ -91,7 +91,7 @@

detect_attack(const unsigned char *buf, word32 len)

{

static u_int16_t *h = (u_int16_t *) NULL;

- static u_int16_t n = HASH_MINSIZE / HASH_ENTRYSIZE;

+ static u_int32_t n = HASH_MINSIZE / HASH_ENTRYSIZE;

register word32 i, j;

word32 l;

const unsigned char *c, *d;

8

OpenSSH 2.2.0:

8

--- deattack.c.orig Wed Feb 7 14:18:23 2001

+++ deattack.c Wed Feb 7 14:19:33 2001

@@ -84,7 +84,7 @@

detect_attack(unsigned char *buf, u_int32_t len, unsigned char *IV)

{

static u_int16_t *h = (u_int16_t *) NULL;

- static u_int16_t n = HASH_MINSIZE / HASH_ENTRYSIZE;

+ static u_int32_t n = HASH_MINSIZE / HASH_ENTRYSIZE;

register u_int32_t i, j;

u_int32_t l;

register unsigned char *c;

8

DSA-027-1：New OpenSSH packages released

链接： http://www.debian.org/security/2001/dsa-027

补丁下载：

Source archives:

http://security.debian.org/dists/stable/updates/main/source/openssh_1.2.3-9.2.diff.gz

http://security.debian.org/dists/stable/updates/main/source/openssh_1.2.3-9.2.dsc

http://security.debian.org/dists/stable/updates/main/source/openssh_1.2.3.orig.tar.gz

Intel ia32 architecture:

http://security.debian.org/dists/stable/updates/main/binary-i386/ssh-askpass-gnome_1.2.3-9.2_i386.deb

http://security.debian.org/dists/stable/updates/main/binary-i386/ssh_1.2.3-9.2_i386.deb

Motorola 680x0 architecture:

http://security.debian.org/dists/stable/updates/main/binary-m68k/ssh-askpass-gnome_1.2.3-9.2_m68k.deb

http://security.debian.org/dists/stable/updates/main/binary-m68k/ssh_1.2.3-9.2_m68k.deb

Sun Sparc architecture:

http://security.debian.org/dists/stable/updates/main/binary-sparc/ssh_1.2.3-9.2_sparc.deb

http://security.debian.org/dists/stable/updates/main/binary-sparc/ssh-askpass-gnome_1.2.3-9.2_sparc.deb

Alpha architecture:

http://security.debian.org/dists/stable/updates/main/binary-alpha/ssh-askpass-gnome_1.2.3-9.2_alpha.deb

http://security.debian.org/dists/stable/updates/main/binary-alpha/ssh_1.2.3-9.2_alpha.deb

PowerPC architecture:

http://security.debian.org/dists/stable/updates/main/binary-p

补丁安装方法：

1. 手工安装补丁包：

首先，使用下面的命令来下载补丁软件：

# wget url (url是补丁下载链接地址)

然后，使用下面的命令来安装补丁：

# dpkg -i file.deb (file是相应的补丁名)

2. 使用apt-get自动安装补丁包：

首先，使用下面的命令更新内部数据库：

# apt-get update

然后，使用下面的命令安装更新软件包：

# apt-get upgrade OpenSSH ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

http://www.openssh.com/ SSH Communications Security --------------------------- 厂商已经在最新版本的软件中修补了这个安全漏洞，SSH公司建议您升级到2.x版本并禁止兼容SSH1，请到如下网站下载最新版本：

http://www.ssh.com

来源:CERT/CC Advisory: CA-2001-35 名称: CA-2001-35 链接:http://www.cert.org/advisories/CA-2001-35.html 来源: BID 名称: 2347 链接:http://www.securityfocus.com/bid/2347 来源: BINDVIEW 名称: 20010208 Remote vulnerability in SSH daemon crc32 compensation attack detector 链接:http://razor.bindview.com/publish/advisories/adv_ssh1crc.html 来源: BUGTRAQ 名称: 20010208 [CORE SDI ADVISORY] SSH1 CRC-32 compensation attack detector 链接:http://marc.theaimsgroup.com/?l=bugtraq&m=98168366406903&w=2 来源: XF 名称: ssh-deattack-overwrite-memory(6083) 链接:http://xforce.iss.net/static/6083.php 来源: OSVDB 名称: 795 链接:http://www.osvdb.org/795 来源: OSVDB 名称: 503 链接:http://www.osvdb.org/503