diff options
author | Colin Watson <cjwatson@debian.org> | 2018-08-17 12:28:26 +0100 |
---|---|---|
committer | Colin Watson <cjwatson@debian.org> | 2018-08-17 12:31:27 +0100 |
commit | 4641c58a3279f6b118f9562babaa0ee050a38619 (patch) | |
tree | 87718b668ec8a737c1729ee568207c2a384f6d61 /auth2-hostbased.c | |
parent | daf34b85afe25c10fac13e9cff16b25c3e3914e9 (diff) | |
parent | c4ca1497658e0508e8595ad74978c07bc92a18e3 (diff) |
Fix user enumeration vulnerability
Apply upstream patch to delay bailout for invalid authenticating user
until after the packet containing the request has been fully parsed.
Closes: #906236
Diffstat (limited to 'auth2-hostbased.c')
-rw-r--r-- | auth2-hostbased.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/auth2-hostbased.c b/auth2-hostbased.c index 8996f7e05..82a7dcdae 100644 --- a/auth2-hostbased.c +++ b/auth2-hostbased.c | |||
@@ -67,10 +67,6 @@ userauth_hostbased(struct ssh *ssh) | |||
67 | size_t alen, blen, slen; | 67 | size_t alen, blen, slen; |
68 | int r, pktype, authenticated = 0; | 68 | int r, pktype, authenticated = 0; |
69 | 69 | ||
70 | if (!authctxt->valid) { | ||
71 | debug2("%s: disabled because of invalid user", __func__); | ||
72 | return 0; | ||
73 | } | ||
74 | /* XXX use sshkey_froms() */ | 70 | /* XXX use sshkey_froms() */ |
75 | if ((r = sshpkt_get_cstring(ssh, &pkalg, &alen)) != 0 || | 71 | if ((r = sshpkt_get_cstring(ssh, &pkalg, &alen)) != 0 || |
76 | (r = sshpkt_get_string(ssh, &pkblob, &blen)) != 0 || | 72 | (r = sshpkt_get_string(ssh, &pkblob, &blen)) != 0 || |
@@ -118,6 +114,11 @@ userauth_hostbased(struct ssh *ssh) | |||
118 | goto done; | 114 | goto done; |
119 | } | 115 | } |
120 | 116 | ||
117 | if (!authctxt->valid || authctxt->user == NULL) { | ||
118 | debug2("%s: disabled because of invalid user", __func__); | ||
119 | goto done; | ||
120 | } | ||
121 | |||
121 | if ((b = sshbuf_new()) == NULL) | 122 | if ((b = sshbuf_new()) == NULL) |
122 | fatal("%s: sshbuf_new failed", __func__); | 123 | fatal("%s: sshbuf_new failed", __func__); |
123 | /* reconstruct packet */ | 124 | /* reconstruct packet */ |