CVE-2015-5600: sshd(8): Fix circumvention of MaxAuthTries using keyboard-interactive authentication (closes: #793616).

2 files changed, 54 insertions, 0 deletions

diff --git a/debian/patches/backport-kbdint-duplicates.patch b/debian/patches/backport-kbdint-duplicates.patch
new file mode 100644
index 000000000..0973503c9
--- /dev/null
+++ b/debian/patches/backport-kbdint-duplicates.patch
@@ -0,0 +1,53 @@
+From ba9e0b1d4edf5876b289affd9d31bab493f0d0a4 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Sat, 18 Jul 2015 07:57:14 +0000
+Subject: only query each keyboard-interactive device once per authentication
+ request regardless of how many times it is listed
+
+ok markus@
+
+Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=5b64f85bb811246c59ebab70aed331f26ba37b18
+Forwarded: not-needed
+Last-Update: 2015-08-19
+
+Patch-Name: backport-kbdint-duplicates.patch
+---
+ auth2-chall.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/auth2-chall.c b/auth2-chall.c
+index ddabe1a..4aff09d 100644
+--- a/auth2-chall.c
++++ b/auth2-chall.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: auth2-chall.c,v 1.42 2015/01/19 20:07:45 markus Exp $ */
++/* $OpenBSD: auth2-chall.c,v 1.43 2015/07/18 07:57:14 djm Exp $ */
+ /*
+  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
+  * Copyright (c) 2001 Per Allansson.  All rights reserved.
+@@ -83,6 +83,7 @@ struct KbdintAuthctxt
+        void *ctxt;
+        KbdintDevice *device;
+        u_int nreq;
++       u_int devices_done;
+ };
+ 
+ #ifdef USE_PAM
+@@ -169,11 +170,15 @@ kbdint_next_device(Authctxt *authctxt, KbdintAuthctxt *kbdintctxt)
+                if (len == 0)
+                        break;
+                for (i = 0; devices[i]; i++) {
+-                       if (!auth2_method_allowed(authctxt,
++                       if ((kbdintctxt->devices_done & (1 << i)) != 0 ||
++                           !auth2_method_allowed(authctxt,
+                            "keyboard-interactive", devices[i]->name))
+                                continue;
+-                       if (strncmp(kbdintctxt->devices, devices[i]->name, len) == 0)
++                       if (strncmp(kbdintctxt->devices, devices[i]->name,
++                           len) == 0) {
+                                kbdintctxt->device = devices[i];
++                               kbdintctxt->devices_done |= 1 << i;
++                       }
+                }
+                t = kbdintctxt->devices;
+                kbdintctxt->devices = t[len] ? xstrdup(t+len+1) : NULL;
diff --git a/debian/patches/series b/debian/patches/series
index 1a843eac8..188ec8abc 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -30,3 +30,4 @@ debian-config.patch
 backport-fix-pty-permissions.patch
 backport-do-not-resend-username-to-pam.patch
 backport-pam-use-after-free.patch
+backport-kbdint-duplicates.patch