openssh 6.3 regex injection vectors: inject into ruser and/or exploiting pre-specified limits set for user provided data #426
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
… too long rhost -- do not impose length limits for user-provided input since daemon might eventually change reported length and we would need to adjust anyways. So limiting in length does not provide additional security but allows for a possible injection vector
|
Well done and thanks Colin. I'll try to write the generic case for this exploit in DEVELOP. Ideally this should be the kind of notes that also appear in DEV Notes: section of filters. The 100 limits on user and host where based on the source but I'm happy for these to be width unlimited: ./auth2-hostbased.c: "client user \"%.100s\", client host \"%.100s\"", cuser, chost); ./auth1.c: auth_info(authctxt, "ruser %.100s", client_user); |
|
yeap - original length limiting is based on the source code, but imho absent limit is just to foolproof against possible future changes/custom patched builds etc. I will add a brief statement into DEV notes and will merge then |
yarikoptic
added a commit
that referenced
this pull request
Nov 8, 2013
openssh 6.3 regex injection vectors: inject into ruser and/or exploiting pre-specified limits set for user provided data
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
resolution -- non-greedy matching prior
<HOST>+ removing length limits