Fwd: [raptor@mediaservice.net: OpenSSH/PAM timing attack allows

[Andrzej Krzysztofowicz]

> On Wed, 30 Apr 2003, PLD w Repcio wrote:
> > Sprawdziłem na 2 maszynach z domyślną konfiguracja OpenSSH
> > potwierdzone..
> [..]
> > 1. Abstract.
> > 
> > During a pen-test we stumbled across a nasty bug in OpenSSH-portable with PAM
> > support enabled (via the --with-pam configure script switch). This bug allows a 
> > remote attacker to identify valid users on vulnerable systems, through a simple
> > timing attack. The vulnerability is easy to exploit and may have high severity,
> > if combined with poor password policies and other security problems that allow 
> > local privilege escalation.
> > 
> > 2. Example Attack Session.
> > 
> > root w voodoo:~# ssh [valid_user]@lab.mediaservice.net
> > [valid_user]@lab.mediaservice.net's password:   <- arbitrary (non-null) string
> > [2 secs delay]
> > Permission denied, please try again.
> > 
> > root w voodoo:~# ssh [no_such_user]@lab.mediaservice.net
> > [no_such_user]@lab.mediaservice.net's password: <- arbitrary (non-null) string
> > [no delay]
> > Permission denied, please try again.
> 
> [kloczek w test1 rpm]$ ssh eciepecie w localhost
> Password: 
> Password: 
> Password: 

Te 3 proby weryfikacji hasla to kwestia klienta, wiec nic do tematu nie
wnosza.

> eciepecie w localhost's password:			<=============
> Permission denied, please try again.
> eciepecie w localhost's password: 
> Permission denied, please try again.
> eciepecie w localhost's password: 
> Received disconnect from 127.0.0.1: 2: Too many authentication failures for eciepecie
> 
> U nas krótszy czas przed ponownym logowaniem zaczyna sie dopiero w meijscu 
> zaznaczonym.
> Danie nodelay to takie średnie rozwiazanie.
> 
> Tak czy inaczje sprawa nie jest IMHO krytyczna.
> 
> kloczek
> -- 
> -----------------------------------------------------------
> *Ludzie nie mają problemów, tylko sobie sami je stwarzają*
> -----------------------------------------------------------
> Tomasz Kłoczko, sys adm @zie.pg.gda.pl|*e-mail: kloczek w rudy.mif.pg.gda.pl*
> 
> ________________________
> http://lists.pld.org.pl/
> 


-- 
=======================================================================
  Andrzej M. Krzysztofowicz               ankry w mif.pg.gda.pl
  phone (48)(58) 347 14 61
Faculty of Applied Phys. & Math.,   Gdansk University of Technology