News

SB 16.02 :: Bug im SSH-Client erlaubt Auslesen der clientseitigen Private-Keys ( CVE-2016-0777 CVE-2016-0778 )

2016.01.14

Ein kritischer Bug in OpenBSDs SSH-Client erlaubt es einem bösartigen Server, die Private Keys des Clients auszulesen. Das Problem besteht in einer experimentellen, undokumentierten Funktion "UseRoaming"; ein Auslesen der Keys via MitM ist nicht möglich.

Als Workaround empfiehl sich, die Oprion UseRoaming no in /etc/ssh/ssh_config oder ~/.ssh/config einzufügen

 * SECURITY: ssh(1): The OpenSSH client code between 5.4 and 7.1
   contains experimential support for resuming SSH-connections (roaming).

   The matching server code has never been shipped, but the client
   code was enabled by default and could be tricked by a malicious
   server into leaking client memory to the server, including private
   client user keys.

   The authentication of the server host key prevents exploitation
   by a man-in-the-middle, so this information leak is restricted
   to connections to malicious or compromised servers.

   MITIGATION: For OpenSSH >= 5.4 the vulnerable code in the client
   can be completely disabled by adding 'UseRoaming no' to the gobal
   ssh_config(5) file, or to user configuration in ~/.ssh/config,
   or by passing -oUseRoaming=no on the command line.

User, die ssh-agent benutzen sind nicht betroffen:

If you use ssh-agent(1), however, the man page offers some 
good news: The agent will never send a private key over its 
request channel. Instead, operations that require a private key 
will be performed by the agent, and the result will be
returned to the requester. This way, private keys are not 
exposed to clients using the agent

Mitigations

Updates stehen bereit; bis dahin hilft:

echo -e 'Host *\nUseRoaming no' >> /etc/ssh/ssh_config

oder 

echo -e 'Host *\nUseRoaming no' >>  ~/.ssh/ssh_config

Referenzen




You code … we platform.