CVE-2015-5600: sshd(8): Fix circumvention of MaxAuthTries using keyboard-interactive authentication (closes: #793616).

5 files changed, 71 insertions, 5 deletions

diff --git a/auth2-chall.c b/auth2-chall.c
index ddabe1a90..4aff09d80 100644
--- a/auth2-chall.c
+++ b/auth2-chall.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-chall.c,v 1.42 2015/01/19 20:07:45 markus Exp $ */
+/* $OpenBSD: auth2-chall.c,v 1.43 2015/07/18 07:57:14 djm Exp $ */
 /*
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
  * Copyright (c) 2001 Per Allansson.  All rights reserved.
@@ -83,6 +83,7 @@ struct KbdintAuthctxt
         void *ctxt;
         KbdintDevice *device;
         u_int nreq;
+        u_int devices_done;
 };
 
 #ifdef USE_PAM
@@ -169,11 +170,15 @@ kbdint_next_device(Authctxt *authctxt, KbdintAuthctxt *kbdintctxt)
                 if (len == 0)
                         break;
                 for (i = 0; devices[i]; i++) {
-                        if (!auth2_method_allowed(authctxt,
+                        if ((kbdintctxt->devices_done & (1 << i)) != 0 ||
+                            !auth2_method_allowed(authctxt,
                             "keyboard-interactive", devices[i]->name))
                                 continue;
-                        if (strncmp(kbdintctxt->devices, devices[i]->name, len) == 0)
+                        if (strncmp(kbdintctxt->devices, devices[i]->name,
+                            len) == 0) {
                                 kbdintctxt->device = devices[i];
+                                kbdintctxt->devices_done |= 1 << i;
+                        }
                 }
                 t = kbdintctxt->devices;
                 kbdintctxt->devices = t[len] ? xstrdup(t+len+1) : NULL;
diff --git a/debian/.git-dpm b/debian/.git-dpm
index 13b023289..f64723622 100644
--- a/debian/.git-dpm
+++ b/debian/.git-dpm
@@ -1,6 +1,6 @@
 # see git-dpm(1) from git-dpm package
-c0ec3def4bec4afe1cad9e99081e658200b13a02
-c0ec3def4bec4afe1cad9e99081e658200b13a02
+ba9e0b1d4edf5876b289affd9d31bab493f0d0a4
+ba9e0b1d4edf5876b289affd9d31bab493f0d0a4
 544df7a04ae5b5c1fc30be7c445ad685d7a02dc9
 544df7a04ae5b5c1fc30be7c445ad685d7a02dc9
 openssh_6.9p1.orig.tar.gz
diff --git a/debian/changelog b/debian/changelog
index 8e8e9d778..252bc394f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -144,6 +144,13 @@ openssh (1:6.9p1-1) UNRELEASED; urgency=medium
       reachable by attackers who could compromise the pre-authentication
       process for remote code execution (closes: #795711).  Also reported by
       Moritz Jodeit.
+    - CVE-2015-5600: sshd(8): Fix circumvention of MaxAuthTries using
+      keyboard-interactive authentication (closes: #793616).  By specifying
+      a long, repeating keyboard-interactive "devices" string, an attacker
+      could request the same authentication method be tried thousands of
+      times in a single pass.  The LoginGraceTime timeout in sshd(8) and any
+      authentication failure delays implemented by the authentication
+      mechanism itself were still applied.  Found by Kingcope.
   * Thanks to Jakub Jelen of Red Hat for Fedora's rebased version of the
     GSSAPI key exchange patch.
 
diff --git a/debian/patches/backport-kbdint-duplicates.patch b/debian/patches/backport-kbdint-duplicates.patch
new file mode 100644
index 000000000..0973503c9
--- /dev/null
+++ b/debian/patches/backport-kbdint-duplicates.patch
@@ -0,0 +1,53 @@
+From ba9e0b1d4edf5876b289affd9d31bab493f0d0a4 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Sat, 18 Jul 2015 07:57:14 +0000
+Subject: only query each keyboard-interactive device once per authentication
+ request regardless of how many times it is listed
+
+ok markus@
+
+Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=5b64f85bb811246c59ebab70aed331f26ba37b18
+Forwarded: not-needed
+Last-Update: 2015-08-19
+
+Patch-Name: backport-kbdint-duplicates.patch
+---
+ auth2-chall.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/auth2-chall.c b/auth2-chall.c
+index ddabe1a..4aff09d 100644
+--- a/auth2-chall.c
++++ b/auth2-chall.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: auth2-chall.c,v 1.42 2015/01/19 20:07:45 markus Exp $ */
++/* $OpenBSD: auth2-chall.c,v 1.43 2015/07/18 07:57:14 djm Exp $ */
+ /*
+  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
+  * Copyright (c) 2001 Per Allansson.  All rights reserved.
+@@ -83,6 +83,7 @@ struct KbdintAuthctxt
+        void *ctxt;
+        KbdintDevice *device;
+        u_int nreq;
++       u_int devices_done;
+ };
+ 
+ #ifdef USE_PAM
+@@ -169,11 +170,15 @@ kbdint_next_device(Authctxt *authctxt, KbdintAuthctxt *kbdintctxt)
+                if (len == 0)
+                        break;
+                for (i = 0; devices[i]; i++) {
+-                       if (!auth2_method_allowed(authctxt,
++                       if ((kbdintctxt->devices_done & (1 << i)) != 0 ||
++                           !auth2_method_allowed(authctxt,
+                            "keyboard-interactive", devices[i]->name))
+                                continue;
+-                       if (strncmp(kbdintctxt->devices, devices[i]->name, len) == 0)
++                       if (strncmp(kbdintctxt->devices, devices[i]->name,
++                           len) == 0) {
+                                kbdintctxt->device = devices[i];
++                               kbdintctxt->devices_done |= 1 << i;
++                       }
+                }
+                t = kbdintctxt->devices;
+                kbdintctxt->devices = t[len] ? xstrdup(t+len+1) : NULL;
diff --git a/debian/patches/series b/debian/patches/series
index 1a843eac8..188ec8abc 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -30,3 +30,4 @@ debian-config.patch
 backport-fix-pty-permissions.patch
 backport-do-not-resend-username-to-pam.patch
 backport-pam-use-after-free.patch
+backport-kbdint-duplicates.patch