6e10fc74fd
- Security: Fix double-free in server TCP listener cleanup A double-free in the server could be triggered by an authenticated user if dropbear is running with -a (Allow connections to forwarded ports from any host) This could potentially allow arbitrary code execution as root by an authenticated user. Affects versions 2013.56 to 2016.74. Thanks to Mark Shepard for reporting the crash. CVE-2017-9078 https://secure.ucc.asn.au/hg/dropbear/rev/c8114a48837c - Security: Fix information disclosure with ~/.ssh/authorized_keys symlink. Dropbear parsed authorized_keys as root, even if it were a symlink. The fix is to switch to user permissions when opening authorized_keys A user could symlink their ~/.ssh/authorized_keys to a root-owned file they couldn't normally read. If they managed to get that file to contain valid authorized_keys with command= options it might be possible to read other contents of that file. This information disclosure is to an already authenticated user. Thanks to Jann Horn of Google Project Zero for reporting this. CVE-2017-9079 https://secure.ucc.asn.au/hg/dropbear/rev/0d889b068123 Refresh patches, rework 100-pubkey_path.patch to work with new authorized_keys validation. Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
87 lines
2.6 KiB
Diff
87 lines
2.6 KiB
Diff
--- a/svr-authpubkey.c
|
|
+++ b/svr-authpubkey.c
|
|
@@ -220,14 +220,20 @@ static int checkpubkey(char* algo, unsig
|
|
goto out;
|
|
}
|
|
|
|
- /* we don't need to check pw and pw_dir for validity, since
|
|
- * its been done in checkpubkeyperms. */
|
|
- len = strlen(ses.authstate.pw_dir);
|
|
- /* allocate max required pathname storage,
|
|
- * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
|
|
- filename = m_malloc(len + 22);
|
|
- snprintf(filename, len + 22, "%s/.ssh/authorized_keys",
|
|
- ses.authstate.pw_dir);
|
|
+ if (ses.authstate.pw_uid != 0) {
|
|
+ /* we don't need to check pw and pw_dir for validity, since
|
|
+ * its been done in checkpubkeyperms. */
|
|
+ len = strlen(ses.authstate.pw_dir);
|
|
+ /* allocate max required pathname storage,
|
|
+ * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
|
|
+ filename = m_malloc(len + 22);
|
|
+ snprintf(filename, len + 22, "%s/.ssh/authorized_keys",
|
|
+ ses.authstate.pw_dir);
|
|
+ } else {
|
|
+ filename = m_malloc(30);
|
|
+ strncpy(filename, "/etc/dropbear/authorized_keys", 30);
|
|
+ }
|
|
+
|
|
|
|
/* open the file as the authenticating user. */
|
|
origuid = getuid();
|
|
@@ -396,26 +402,35 @@ static int checkpubkeyperms() {
|
|
goto out;
|
|
}
|
|
|
|
- /* allocate max required pathname storage,
|
|
- * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
|
|
- filename = m_malloc(len + 22);
|
|
- strncpy(filename, ses.authstate.pw_dir, len+1);
|
|
-
|
|
- /* check ~ */
|
|
- if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
|
|
- goto out;
|
|
- }
|
|
-
|
|
- /* check ~/.ssh */
|
|
- strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */
|
|
- if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
|
|
- goto out;
|
|
- }
|
|
-
|
|
- /* now check ~/.ssh/authorized_keys */
|
|
- strncat(filename, "/authorized_keys", 16);
|
|
- if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
|
|
- goto out;
|
|
+ if (ses.authstate.pw_uid == 0) {
|
|
+ if (checkfileperm("/etc/dropbear") != DROPBEAR_SUCCESS) {
|
|
+ goto out;
|
|
+ }
|
|
+ if (checkfileperm("/etc/dropbear/authorized_keys") != DROPBEAR_SUCCESS) {
|
|
+ goto out;
|
|
+ }
|
|
+ } else {
|
|
+ /* allocate max required pathname storage,
|
|
+ * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
|
|
+ filename = m_malloc(len + 22);
|
|
+ strncpy(filename, ses.authstate.pw_dir, len+1);
|
|
+
|
|
+ /* check ~ */
|
|
+ if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
|
|
+ goto out;
|
|
+ }
|
|
+
|
|
+ /* check ~/.ssh */
|
|
+ strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */
|
|
+ if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
|
|
+ goto out;
|
|
+ }
|
|
+
|
|
+ /* now check ~/.ssh/authorized_keys */
|
|
+ strncat(filename, "/authorized_keys", 16);
|
|
+ if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
|
|
+ goto out;
|
|
+ }
|
|
}
|
|
|
|
/* file looks ok, return success */
|