This release fixes a number of security bugs and has minor new features and bug fixes. Security fixes, from the release notes (https://www.openssh.com/txt/release-9.3): This release contains fixes for a security problem and a memory safety problem. The memory safety problem is not believed to be exploitable, but we report most network-reachable memory faults as security bugs. * ssh-add(1): when adding smartcard keys to ssh-agent(1) with the per-hop destination constraints (ssh-add -h ...) added in OpenSSH 8.9, a logic error prevented the constraints from being communicated to the agent. This resulted in the keys being added without constraints. The common cases of non-smartcard keys and keys without destination constraints are unaffected. This problem was reported by Luci Stanescu. * ssh(1): Portable OpenSSH provides an implementation of the getrrsetbyname(3) function if the standard library does not provide it, for use by the VerifyHostKeyDNS feature. A specifically crafted DNS response could cause this function to perform an out-of-bounds read of adjacent stack data, but this condition does not appear to be exploitable beyond denial-of- service to the ssh(1) client. The getrrsetbyname(3) replacement is only included if the system's standard library lacks this function and portable OpenSSH was not compiled with the ldns library (--with-ldns). getrrsetbyname(3) is only invoked if using VerifyHostKeyDNS to fetch SSHFP records. This problem was found by the Coverity static analyzer. Sponsored by: The FreeBSD Foundation
61 lines
1.4 KiB
Bash
61 lines
1.4 KiB
Bash
# $OpenBSD: agent-getpeereid.sh,v 1.15 2023/02/08 08:06:03 dtucker Exp $
|
|
# $OpenBSD: agent-getpeereid.sh,v 1.13 2021/09/01 00:50:27 dtucker Exp $
|
|
# Placed in the Public Domain.
|
|
|
|
tid="disallow agent attach from other uid"
|
|
|
|
UNPRIV=nobody
|
|
ASOCK=${OBJ}/agent
|
|
SSH_AUTH_SOCK=/nonexistent
|
|
>$OBJ/ssh-agent.log
|
|
>$OBJ/ssh-add.log
|
|
|
|
if config_defined HAVE_GETPEEREID HAVE_GETPEERUCRED HAVE_SO_PEERCRED ; then
|
|
:
|
|
else
|
|
skip "skipped (not supported on this platform)"
|
|
fi
|
|
if test "x$USER" = "xroot"; then
|
|
skip "skipped (running as root)"
|
|
fi
|
|
case "x$SUDO" in
|
|
xsudo) sudo=1;;
|
|
xdoas|xdoas\ *) ;;
|
|
x)
|
|
skip "need SUDO to switch to uid $UNPRIV" ;;
|
|
*)
|
|
skip "unsupported $SUDO - "doas" and "sudo" are allowed" ;;
|
|
esac
|
|
|
|
trace "start agent"
|
|
eval `${SSHAGENT} ${EXTRA_AGENT_ARGS} -s -a ${ASOCK}` >$OBJ/ssh-agent.log 2>&1
|
|
r=$?
|
|
if [ $r -ne 0 ]; then
|
|
fail "could not start ssh-agent: exit code $r"
|
|
else
|
|
chmod 644 ${SSH_AUTH_SOCK}
|
|
|
|
${SSHADD} -vvv -l >>$OBJ/ssh-add.log 2>&1
|
|
r=$?
|
|
if [ $r -ne 1 ]; then
|
|
fail "ssh-add failed with $r != 1"
|
|
fi
|
|
if test -z "$sudo" ; then
|
|
# doas
|
|
${SUDO} -n -u ${UNPRIV} ${SSHADD} -l 2>/dev/null
|
|
else
|
|
# sudo
|
|
< /dev/null ${SUDO} -S -u ${UNPRIV} ${SSHADD} -vvv -l >>$OBJ/ssh-add.log 2>&1
|
|
fi
|
|
r=$?
|
|
if [ $r -lt 2 ]; then
|
|
fail "ssh-add did not fail for ${UNPRIV}: $r < 2"
|
|
cat $OBJ/ssh-add.log
|
|
fi
|
|
|
|
trace "kill agent"
|
|
${SSHAGENT} -k >>$OBJ/ssh-agent.log 2>&1
|
|
fi
|
|
|
|
rm -f ${OBJ}/agent
|