Bug 410869 (CVE-2011-5000)

Summary:	<net-misc/openssh-5.9_p1-r4 : post-authentication resource exhaustion bug via GSSAPI (CVE-2011-5000)
Product:	Gentoo Security	Reporter:	Agostino Sarubbo <ago>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	base-system, robbat2
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://bugzilla.redhat.com/show_bug.cgi?id=809938
Whiteboard:	A3 [glsa]
Package list:		Runtime testing required:	---
Bug Depends on:	396075
Bug Blocks:

Description Agostino Sarubbo gentoo-dev

2012-04-05 12:23:28 UTC

From redhat bugzilla at $URL:

Common Vulnerabilities and Exposures assigned an identifier CVE-2011-5000 to
the following vulnerability:

Name: CVE-2011-5000
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5000
Assigned: 20111224
Reference: FULLDISC:20110801 Useless OpenSSH resources exhausion bug via GSSAPI
Reference: http://seclists.org/fulldisclosure/2011/Aug/2
Reference: http://site.pi3.com.pl/adv/ssh_1.txt

The ssh_gssapi_parse_ename function in gss-serv.c in OpenSSH 5.8 and
earlier, when gssapi-with-mic authentication is enabled, allows remote
authenticated users to cause a denial of service (memory consumption)
via a large value in a certain length field.  NOTE: there may be
limited scenarios in which this issue is relevant.


The upstream fix for this is here:

http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/gss-serv.c.diff?r1=1.22;r2=1.23

Also note that this is a POST-authentication bug, meaning that an attacker
would need to have valid credentials to successfully authenticate to the server
in order to exploit this.  If a user already has the ability to log into the
server, there are a number of other mechanisms that could be exploited
(arguably easier) to consume excessive resources on the server.

Comment 1 SpanKY gentoo-dev

2012-04-09 00:05:23 UTC

looks like it's already fixed in 5.9_p1.  so just stabilize openssh-5.9_p1-r4.

Comment 2 GLSAMaker/CVETool Bot gentoo-dev

2012-04-10 21:29:37 UTC

CVE-2011-5000 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-5000):
  The ssh_gssapi_parse_ename function in gss-serv.c in OpenSSH 5.8 and
  earlier, when gssapi-with-mic authentication is enabled, allows remote
  authenticated users to cause a denial of service (memory consumption) via a
  large value in a certain length field.  NOTE: there may be limited scenarios
  in which this issue is relevant.

Comment 3 Agostino Sarubbo gentoo-dev

2012-06-02 21:52:35 UTC

Added to existing glsa request.

Comment 4 GLSAMaker/CVETool Bot gentoo-dev

2014-05-11 13:56:34 UTC

This issue was resolved and addressed in
 GLSA 201405-06 at http://security.gentoo.org/glsa/glsa-201405-06.xml
by GLSA coordinator Mikle Kolyada (Zlogene).