untrusted comment: signature from openbsd 5.7 base secret key
RWSvUZXnw9gUb+vi10cqgMKu2LfcwOkFdyx8OskgpLkH/O/AEOTn1gEsaBmr4HvlTlnd9Z8egvmDvfB1SL4pcM6+g3+kcS5TtwI=
OpenBSD 5.7 errata 23, Mar 10, 2016:
Lack of credential sanitization allows injection of commands to xauth(1).
More information:
http://www.openssh.com/txt/x11fwd.adv
Prevent this problem immediately by not using the "X11Forwarding" feature
(which is disabled by default).
Apply by doing:
signify -Vep /etc/signify/openbsd-57-base.pub -x 023_sshd.patch.sig \
-m - | (cd /usr/src && patch -p0)
And then rebuild and install sshd:
cd /usr/src/usr.bin/ssh
make obj
make depend
make
make install
Index: usr.bin/ssh/session.c
===================================================================
RCS file: /cvs/src/usr.bin/ssh/session.c,v
retrieving revision 1.277
diff -u -p -u -r1.277 session.c
--- usr.bin/ssh/session.c 16 Jan 2015 06:40:12 -0000 1.277
+++ usr.bin/ssh/session.c 9 Mar 2016 17:03:04 -0000
@@ -40,6 +40,7 @@
#include <sys/socket.h>
#include <sys/queue.h>
+#include <ctype.h>
#include <errno.h>
#include <fcntl.h>
#include <grp.h>
@@ -255,6 +256,22 @@ do_authenticated(Authctxt *authctxt)
do_cleanup(authctxt);
}
+/* Check untrusted xauth strings for metacharacters */
+static int
+xauth_valid_string(const char *s)
+{
+ size_t i;
+
+ for (i = 0; s[i] != '\0'; i++) {
+ if (!isalnum((u_char)s[i]) &&
+ s[i] != '.' && s[i] != ':' && s[i] != '/' &&
+ s[i] != '-' && s[i] != '_' && s[i] != '[' &&
+ s[i] != ']')
+ return 0;
+ }
+ return 1;
+}
+
/*
* Prepares for an interactive session. This is called after the user has
* been successfully authenticated. During this message exchange, pseudo
@@ -328,7 +345,13 @@ do_authenticated1(Authctxt *authctxt)
s->screen = 0;
}
packet_check_eom();
- success = session_setup_x11fwd(s);
+ if (xauth_valid_string(s->auth_proto) &&
+ xauth_valid_string(s->auth_data))
+ success = session_setup_x11fwd(s);
+ else {
+ success = 0;
+ error("Invalid X11 forwarding data");
+ }
if (!success) {
free(s->auth_proto);
free(s->auth_data);
@@ -1800,7 +1823,13 @@ session_x11_req(Session *s)
s->screen = packet_get_int();
packet_check_eom();
- success = session_setup_x11fwd(s);
+ if (xauth_valid_string(s->auth_proto) &&
+ xauth_valid_string(s->auth_data))
+ success = session_setup_x11fwd(s);
+ else {
+ success = 0;
+ error("Invalid X11 forwarding data");
+ }
if (!success) {
free(s->auth_proto);
free(s->auth_data);
