Home / ubuntu / Questions / 651739
Accepted
Sonny
Asked: 2015-07-24 05:44:10 +0800 CST

Ubuntu 12.04, PCI, and CVE-2015-5352

  • 772

PCI compliance will fail when the CVE-2015-5352 vulnerability is present. OpenSSH 6.9 fixes this vulnerability, but none of the supported versions of Ubuntu (12.04, 14.04, 15.04 and 15.10) have been patched.

What is the best way to address this vulnerability?

12.04

3 Answers

  1. I am experiencing the same issue. While I await a fix from ubuntu I have also decided this is an issue I would address with my CSA; for the following reason.

    If I understand the issue presented, the issue only arises if a root user on the affected computer is allowed to forward X11 connections. In my environment, the same root users on the affected computers have access to root on any system reachable from that computer, hence, if they were to conduct malicious activity, this potential vulnerability would neither help nor hinder that user.

    Secondly, if the problem depends upon the ability to forward X11 connections, then shouldn't disabling this feature with "ForwardX11Trusted no" and "ForwardX11Timeout 0" be a proper configuration fix? This is my current configuration and as I have no X11 installs, seems to fit.

    • 1

  2. This is really poor research on the part of whoever added this issue to the PCI compliance scanners. On my scans the problem is described as the following:

    Synopsis

    The SSH server running on the remote host is affected by multiple vulnerabilities.

    Description

    According to its banner, the version of OpenSSH running on the remote host is prior to 6.9. It is, therefore, affected by the following vulnerabilities :

    A flaw exists within the x11_open_helper() function in the 'channels.c' file that allows connections to be permitted after 'ForwardX11Timeout' has expired. A remote attacker can exploit this to bypass timeout checks and XSECURITY restrictions. (CVE-2015-5352)

    Various issues were addressed by fixing the weakness in agent locking by increasing the failure delay, storing the salted hash of the password, and using a timing-safe comparison function.

    An out-of-bounds read error exists when handling incorrect pattern lengths. A remote attacker can exploit this to cause a denial of service or disclose sensitive information in the memory.

    An out-of-bounds read error exists when parsing the 'EscapeChar' configuration option.

    Recommendation

    Upgrade to OpenSSH 6.9 or later.

    Let's break it down:

    A flaw exists within the x11_open_helper() function (CVE-2015-5352)

    This vulnerability is one that affects SSH clients, not SSH servers (desc). An SSH client with an X environment is made vulnerable when connecting to a malicious SSH server using X11 forwarding. The scanner is inherently scanning servers not clients... In most cases, X will not even be installed on the remote server and connections will only be made to trusted servers so the scenario that this vulnerability requires is impossible to replicate.

    Various issues were addressed by fixing the weakness in agent locking

    Again, ssh-agent is a client program so this bug does not affect the security of the server being scanned and upgrading to OpenSSH 6.9 would do nothing to prevent this from being exploited unless the server was already compromised and being used to login to other machines using ssh-agent.

    An out-of-bounds read error exists when handling incorrect pattern lengths

    Looking at the source code reveals that the code which contains the bug is not even present in OpenSSH 6.6 and the OpenSSH 6.8 bug is therefore not applicable. The patch changes how the match_pattern_list() method is used but this method does not exist in OpenSSH 6.6.

    An out-of-bounds read error exists when parsing the 'EscapeChar' configuration option

    This bug is related only to the 'ssh' client program command line or config file parsing, not the sshd server and therefore has nothing to do with a private system which is running sshd. Additionally, this is listed in the Release Notes as a Bug, and not a Security issue so I doubt that it can do anything more than simply cause a segfault on the client machine if incorrect parameters are used.

    Upgrade to OpenSSH 6.9 or later.

    So in summary because of all of these client issues you should upgrade your server to OpenSSH 6.9. Considering that most distributions are not yet supporting 6.9 this is absolutely idiotic advice. My advice is to keep running the latest OpenSSH that is supported by your distro using the standard and security repositories with backported fixes that are actually applicable rather than maintaining your own OpenSSH builds just because the PCI scanner said so.

    • 1
  3. Best Answer

    I found this blog article that listed the steps for manually installing OpenSSH 6.7. I followed the instructions, using OpenSSH 6.9 instead.

    • -1