[Midnightbsd-cvs] src [7467] trunk: OpenSSH doesn't have the luck of the Irish.

[laffer1 at midnightbsd.org]

Revision: 7467
          http://svnweb.midnightbsd.org/src/?rev=7467
Author:   laffer1
Date:     2016-03-17 08:34:11 -0400 (Thu, 17 Mar 2016)
Log Message:
-----------
        OpenSSH doesn't have the luck of the Irish.

        Fix a security issue with OpenSSH X11 forwarding that can allow an attacker
        run shell commands on the call to xauth.

Modified Paths:
--------------
    trunk/UPDATING
    trunk/crypto/openssh/session.c

Modified: trunk/UPDATING
===================================================================
--- trunk/UPDATING	2016-03-10 14:15:56 UTC (rev 7466)
+++ trunk/UPDATING	2016-03-17 12:34:11 UTC (rev 7467)
@@ -1,5 +1,11 @@
 Updating Information for MidnightBSD users.
 
+20160317:
+	OpenSSH doesn't have the luck of the Irish. 
+
+	Fix a security issue with OpenSSH X11 forwarding that can allow an attacker
+	run shell commands on the call to xauth.
+
 20160229:
 	top now displays information on ZFS arc cache.
 

Modified: trunk/crypto/openssh/session.c
===================================================================
--- trunk/crypto/openssh/session.c	2016-03-10 14:15:56 UTC (rev 7466)
+++ trunk/crypto/openssh/session.c	2016-03-17 12:34:11 UTC (rev 7467)
@@ -46,6 +46,7 @@
 
 #include <arpa/inet.h>
 
+#include <ctype.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <grp.h>
@@ -289,6 +290,21 @@
 	do_cleanup(authctxt);
 }
 
+/* Check untrusted xauth strings for metacharacters */
+static int
+xauth_valid_string(const char *s)
+{
+	size_t i;
+
+	for (i = 0; s[i] != '\0'; i++) {
+		if (!isalnum((u_char)s[i]) &&
+		    s[i] != '.' && s[i] != ':' && s[i] != '/' &&
+		    s[i] != '-' && s[i] != '_')
+		return 0;
+	}
+	return 1;
+}
+
 /*
  * Prepares for an interactive session.  This is called after the user has
  * been successfully authenticated.  During this message exchange, pseudo
@@ -362,7 +378,13 @@
 				s->screen = 0;
 			}
 			packet_check_eom();
-			success = session_setup_x11fwd(s);
+			if (xauth_valid_string(s->auth_proto) &&
+			    xauth_valid_string(s->auth_data))
+				success = session_setup_x11fwd(s);
+			else {
+				success = 0;
+				error("Invalid X11 forwarding data");
+			}
 			if (!success) {
 				free(s->auth_proto);
 				free(s->auth_data);
@@ -2183,7 +2205,13 @@
 	s->screen = packet_get_int();
 	packet_check_eom();
 
-	success = session_setup_x11fwd(s);
+	if (xauth_valid_string(s->auth_proto) &&
+	    xauth_valid_string(s->auth_data))
+		success = session_setup_x11fwd(s);
+	else {
+		success = 0;
+		error("Invalid X11 forwarding data");
+	}
 	if (!success) {
 		free(s->auth_proto);
 		free(s->auth_data);