Backport PAM security fixes.

    - sshd(8): Fixed a privilege separation weakness related to PAM support.
      Attackers who could successfully compromise the pre-authentication
      process for remote code execution and who had valid credentials on the
      host could impersonate other users.  Reported by Moritz Jodeit.
    - sshd(8): Fixed a use-after-free bug related to PAM support that was
      reachable by attackers who could compromise the pre-authentication
      process for remote code execution (closes: #795711).  Also reported by
      Moritz Jodeit.

1 files changed, 39 insertions, 0 deletions

diff --git a/debian/patches/backport-pam-use-after-free.patch b/debian/patches/backport-pam-use-after-free.patch
new file mode 100644
index 000000000..460654953
--- /dev/null
+++ b/debian/patches/backport-pam-use-after-free.patch
@@ -0,0 +1,39 @@
+From c0ec3def4bec4afe1cad9e99081e658200b13a02 Mon Sep 17 00:00:00 2001
+From: Damien Miller <djm@mindrot.org>
+Date: Tue, 11 Aug 2015 13:34:12 +1000
+Subject: set sshpam_ctxt to NULL after free
+
+Avoids use-after-free in monitor when privsep child is compromised.
+Reported by Moritz Jodeit; ok dtucker@
+
+Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=5e75f5198769056089fb06c4d738ab0e5abc66f7
+Forwarded: not-needed
+Last-Update: 2015-08-19
+
+Patch-Name: backport-pam-use-after-free.patch
+---
+ monitor.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/monitor.c b/monitor.c
+index 870a6b9..e8541b4 100644
+--- a/monitor.c
++++ b/monitor.c
+@@ -1225,14 +1225,16 @@ mm_answer_pam_respond(int sock, Buffer *m)
+ int
+ mm_answer_pam_free_ctx(int sock, Buffer *m)
+ {
++       int r = sshpam_authok != NULL && sshpam_authok == sshpam_ctxt;
+ 
+        debug3("%s", __func__);
+        (sshpam_device.free_ctx)(sshpam_ctxt);
++       sshpam_ctxt = sshpam_authok = NULL;
+        buffer_clear(m);
+        mm_request_send(sock, MONITOR_ANS_PAM_FREE_CTX, m);
+        auth_method = "keyboard-interactive";
+        auth_submethod = "pam";
+-       return (sshpam_authok == sshpam_ctxt);
++       return r;
+ }
+ #endif
+