Date: Tue, 07 Mar 2006 19:47:57 +0000
From: Pablo Fernandez <pablo@...tleQ.net>
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Dropbear SSH server Denial of Service

Dropbear SSH server Denial of Service

Credits: Pablo Fernandez
March 7th, 2006

I. BACKGROUND

Dropbear is a relatively small SSH 2 server and client. It runs on a
variety of POSIX-based platforms. Dropbear is open source software,
distributed under a MIT-style license. Dropbear is particularly useful
for "embedded"-type Linux (or other Unix) systems, such as wireless
routers.

More information is available at
http://matt.ucc.asn.au/dropbear/dropbear.html

II. DESCRIPTION

Denial of service is possible and could be trivialy launched by a remote
attacker.

The vulnerability specifically exists due to a design error in the
authorization-pending connections code. By default and as a #define of
the MAX_UNAUTH_CLIENTS constant, the SSH server allows 30
authorization-pending connections, after connection 31, incoming sockets
are close()d immediatly.

Vulnerable code is in svr-main.c

/* check for max number of connections not authorised */
for (j = 0; j < MAX_UNAUTH_CLIENTS; j++) {
        if (childpipes[j] < 0) {
                break;
        }
}

if (j == MAX_UNAUTH_CLIENTS) {
        /* no free connections */
        /* TODO - possibly log, though this would be an easy way
         * to fill logs/disk */
        close(childsock);
        continue;
}

III. ANALYSIS

Remote attack of this vulnerability is trivial. This is specially
problematic if the administrator can't login due to the attack and can't
at least blacklist the attacker, restart the service or undertake other
actions.

IV. DETECTION

All versions (up to and including current 0.47 version) are vulnerable.

The following distributions are known to use or package Dropbear:

      * LEAF Bering uClibc - a small Linux firewall/network applicance
        distribution. 
      * NetBSD Packages Collection 
      * Debian 
      * FreeBSD Ports 
      * Gentoo Packages 
      * OpenWRT - a very nice distro for WRT54G wireless routers (and
        others). 
      * FREESCO is is a single floppy NAT/firewall router/server. 
      * Bent Linux - a uClibc based Linux distribution, statically
        linked cpio.bz2 packages (should work on any distro) 
      * fli4l - a one-disk-router Linux distribution 
      * OpenZaurus - custom Linux for the Sharp Zaurus 
      * floppyfw - a single floppy firewall Linux distribution 
      * ttylinux - Linux to fit in 4 megabytes of disk space and run on
        386es, as an internet terminal 
      * Sisela - single floppy Linux router/wireless AP distro 
      * gumstix - tiny embedded Linux boards 
      * OpenSimpad - Linux for the Siemans SIMpad, packages here
        upgrade for Linksys WiFi routers 
      * Slackmatic 
      * Coyote Linux - a single floppy firewall 
      * Trinux - a lightweight Linux security toolkit 
      * Familiar ipkg - for handhelds 
      * Source Mage - a distribution of GNU/Linux, Dropbear is available
        as a spell. 
      * Netcomm NB5 ADSL router - this runs Dropbear out of the box. 
      * Dreambox linux-based DVB recorder has Dropbear on the default
        firmware. 
      * kboot - a proof-of-concept Linux boot loader.

V. WORKAROUND

Administrators running dropbear should wait for a fix from the vendor.
In the mean time, firewalling the SSH server allowing incoming
connections just from trusted sources is adviced.

VI. VENDOR RESPONSE

The vendor has been notified and a solution is under development.

VII. CVE INFORMATION

A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not
been assigned yet.

VIII. DISCLOSURE TIMELINE

30/01/2006  Initial vendor notification
07/03/2006  Public disclosure

IX. CREDIT

Pablo Fernandez <pablo at littleQ.net> is credited with this discovery.

-- 
Pablo Fernandez Lopez
http://www.littleQ.net/

GPG: http://www.littleQ.net/pablo.asc
Fingerprint: 14A0 8343 E8FB E940 59E3  F7BB C347 869D DBB9 337F

View attachment "dropbear-PoC.c" of type "text/x-csrc" (5083 bytes)

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)

Powered by blists - more mailing lists