FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

openssh -- remote denial of service

Affected systems
5.4 < FreeBSD < 5.4_12
5.3 < FreeBSD < 5.3_27

Details

VuXML ID 6a308e8e-b1b4-11da-b2fb-000e0c2e438a
Discovery 2006-03-01
Entry 2006-03-12
Modified 2006-06-09

Problem description:

Because OpenSSH and OpenPAM have conflicting designs (one is event- driven while the other is callback-driven), it is necessary for OpenSSH to fork a child process to handle calls to the PAM framework. However, if the unprivileged child terminates while PAM authentication is under way, the parent process incorrectly believes that the PAM child also terminated. The parent process then terminates, and the PAM child is left behind.

Due to the way OpenSSH performs internal accounting, these orphaned PAM children are counted as pending connections by the master OpenSSH server process. Once a certain number of orphans has accumulated, the master decides that it is overloaded and stops accepting client connections.

Impact:

By repeatedly connecting to a vulnerable server, waiting for a password prompt, and closing the connection, an attacker can cause OpenSSH to stop accepting client connections until the system restarts or an administrator manually kills the orphaned PAM processes.

Workaround:

The following command will show a list of orphaned PAM processes:

# pgrep -lf 'sshd.*\[pam\]'

The following command will kill orphaned PAM processes:

# pkill -f 'sshd.*\[pam\]'

To prevent OpenSSH from leaving orphaned PAM processes behind, perform one of the following:

  1. Disable PAM authentication in OpenSSH. Users will still be able to log in using their Unix password, OPIE or SSH keys.

    To do this, execute the following commands as root:

    # echo 'UsePAM no' >>/etc/ssh/sshd_config
    # echo 'PasswordAuthentication yes' >>/etc/ssh/sshd_config
    # /etc/rc.d/sshd restart
  2. If disabling PAM is not an option - if, for instance, you use RADIUS authentication, or store user passwords in an SQL database - you may instead disable privilege separation. However, this may leave OpenSSH vulnerable to hitherto unknown bugs, and should be considered a last resort.

    To do this, execute the following commands as root:

    # echo 'UsePrivilegeSeparation no' >>/etc/ssh/sshd_config
    # /etc/rc.d/sshd restart

References

CVE Name CVE-2006-0883
FreeBSD Advisory SA-06:09.openssh