lsh-bugs September 2003

lsh-bugs@lists.lysator.liu.se

8 participants
7 discussions

compiling lsh-1.5.3 with tcpwrappers support
by lsh-list＠brennmeister.com 23 Sep '03

23 Sep '03

Hi, after my initial problems with compiling lsh-1.5.3 are solved now, I thought I'll give tcpwrappers a try. Actually, I want to run lsh thru Dan Bernsteins tcpserver [1], and my assumption is that enabling tcpwrappers support for lsh will allow me to do this. If I'm completely wrong here - how can I do it anyway? :) After a configure --with-tcpwrappers, make stops here: make[4]: Entering directory `/usr/local/src/lsh-1.5.3/src' gcc -O2 -march=i386 -mcpu=i686 -fPIC -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -Wl,-rpath,/usr/local/lib -L/usr/X11R6/lib -o lsh lsh.o liblsh.a spki/libspki.a nettle/libnettle.a -lpam -lutil -lcrypt -lXau -lwrap -lz -loop -lgmp /usr/lib/gcc-lib/i386-redhat-linux/2.96/../../../libwrap.a(hosts_access.o): In function `host_match': hosts_access.o(.text+0x616): undefined reference to `yp_get_default_domain' collect2: ld returned 1 exit status make[4]: *** [lsh] Error 1 make[4]: Leaving directory `/usr/local/src/lsh-1.5.3/src' make[3]: *** [all-recursive] Error 1 make[3]: Leaving directory `/usr/local/src/lsh-1.5.3/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/usr/local/src/lsh-1.5.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/local/src/lsh-1.5.3' make: *** [all] Error 2 What's the problem here? System is RedHat 7.1, /usr/lib/libwrap.a belongs to tcp_wrappers-7.6-18. If you need more details, please let me know. Regards Jochen [1] http://cr.yp.to/ucspi-tcp.html

4 9

can't compile lsh 1.5.3
by lsh-list＠brennmeister.com 21 Sep '03

21 Sep '03

Hi, I've tried to upgrade from lsh 1.5.2 to 1.5.3, but I can't compile the new version. 1.5.2 compiles fine. Here's the output from make (after a plain ./configure): gcc -O2 -march=i386 -mcpu=i686 -fPIC -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -L.. -o rsa-test rsa-test.o testutils.o -lnettle ../libnettle.a -lgmp if gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/lsh-1.5.3/src/nettle/testsuite -I.. -I/usr/local/src/lsh-1.5.3/src/nettle -O2 -march=i386 -mcpu=i686 -fPIC -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -MT rsa-encrypt-test.o -MD -MP -MF ".deps/rsa-encrypt-test.Tpo" \ -c -o rsa-encrypt-test.o `test -f 'rsa-encrypt-test.c' || echo '/usr/local/src/lsh-1.5.3/src/nettle/testsuite/'`rsa-encrypt-test.c; \ then mv ".deps/rsa-encrypt-test.Tpo" ".deps/rsa-encrypt-test.Po"; \ else rm -f ".deps/rsa-encrypt-test.Tpo"; exit 1; \ fi rsa-encrypt-test.c: In function `test_main': rsa-encrypt-test.c:41: warning: implicit declaration of function `gmp_fprintf' gcc -O2 -march=i386 -mcpu=i686 -fPIC -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -L.. -o rsa-encrypt-test rsa-encrypt-test.o testutils.o -lnettle ../libnettle.a -lgmp rsa-encrypt-test.o: In function `test_main': rsa-encrypt-test.o(.text+0x121): undefined reference to `gmp_fprintf' collect2: ld returned 1 exit status make[6]: *** [rsa-encrypt-test] Error 1 make[6]: Leaving directory `/usr/local/src/lsh-1.5.3/src/nettle/testsuite' make[5]: *** [all-recursive] Error 1 make[5]: Leaving directory `/usr/local/src/lsh-1.5.3/src/nettle' make[4]: *** [all] Error 2 make[4]: Leaving directory `/usr/local/src/lsh-1.5.3/src/nettle' make[3]: *** [all-recursive] Error 1 make[3]: Leaving directory `/usr/local/src/lsh-1.5.3/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/usr/local/src/lsh-1.5.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/local/src/lsh-1.5.3' make: *** [all] Error 2 Tried 1.4.3, too - doesn't work either: if gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/lsh-1.4.3/src/argp -I. -D_GNU_SOURCE -I/usr/local/src/lsh-1.4.3/src/argp -O2 -march=i386 -mcpu=i686 -fPIC -ggdb3 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Waggregate-return -Wpointer-arith -Wbad-function-cast -Wnested-externs -MT argp-fmtstream.o -MD -MP -MF ".deps/argp-fmtstream.Tpo" \ -c -o argp-fmtstream.o `test -f 'argp-fmtstream.c' || echo '/usr/local/src/lsh-1.4.3/src/argp/'`argp-fmtstream.c; \ then mv ".deps/argp-fmtstream.Tpo" ".deps/argp-fmtstream.Po"; \ else rm -f ".deps/argp-fmtstream.Tpo"; exit 1; \ fi argp-fmtstream.c: In function `argp_fmtstream_free': argp-fmtstream.c:97: warning: signed and unsigned type in conditional expression argp-fmtstream.c: In function `_argp_fmtstream_update': argp-fmtstream.c:271: warning: signed and unsigned type in conditional expression argp-fmtstream.c: In function `_argp_fmtstream_ensure': argp-fmtstream.c:326: warning: signed and unsigned type in conditional expression if gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/lsh-1.4.3/src/argp -I. -D_GNU_SOURCE -I/usr/local/src/lsh-1.4.3/src/argp -O2 -march=i386 -mcpu=i686 -fPIC -ggdb3 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Waggregate-return -Wpointer-arith -Wbad-function-cast -Wnested-externs -MT argp-help.o -MD -MP -MF ".deps/argp-help.Tpo" \ -c -o argp-help.o `test -f 'argp-help.c' || echo '/usr/local/src/lsh-1.4.3/src/argp/'`argp-help.c; \ then mv ".deps/argp-help.Tpo" ".deps/argp-help.Po"; \ else rm -f ".deps/argp-help.Tpo"; exit 1; \ fi argp-help.c:199: warning: missing initializer argp-help.c:199: warning: (near initialization for `uparam_names[9].is_bool') if gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/lsh-1.4.3/src/argp -I. -D_GNU_SOURCE -I/usr/local/src/lsh-1.4.3/src/argp -O2 -march=i386 -mcpu=i686 -fPIC -ggdb3 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Waggregate-return -Wpointer-arith -Wbad-function-cast -Wnested-externs -MT argp-parse.o -MD -MP -MF ".deps/argp-parse.Tpo" \ -c -o argp-parse.o `test -f 'argp-parse.c' || echo '/usr/local/src/lsh-1.4.3/src/argp/'`argp-parse.c; \ then mv ".deps/argp-parse.Tpo" ".deps/argp-parse.Po"; \ else rm -f ".deps/argp-parse.Tpo"; exit 1; \ fi argp-parse.c:96: warning: missing initializer argp-parse.c:96: warning: (near initialization for `argp_default_options[1].group') argp-parse.c:97: warning: missing initializer argp-parse.c:97: warning: (near initialization for `argp_default_options[2].group') argp-parse.c:99: warning: missing initializer argp-parse.c:99: warning: (near initialization for `argp_default_options[3].group') argp-parse.c:100: warning: missing initializer argp-parse.c:100: warning: (near initialization for `argp_default_options[4].arg') argp-parse.c:160: warning: missing initializer argp-parse.c:160: warning: (near initialization for `argp_version_options[1].arg') argp-parse.c: In function `_option_is_short': argp-parse.c:1294: Internal compiler error in add_abstract_origin_attribute, at dwarf2out.c:7985 Please submit a full bug report. See <URL:http://bugzilla.redhat.com/bugzilla/> for instructions. make[3]: *** [argp-parse.o] Error 1 make[3]: Leaving directory `/usr/local/src/lsh-1.4.3/src/argp' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/lsh-1.4.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/local/src/lsh-1.4.3' make: *** [all] Error 2 Any ideas what's going wrong here? Thanks Jochen

3 5

《大至急御連絡致します》必ずお読み下さい
by info＠dkc.com 21 Sep '03

21 Sep '03

DATA管理番号:BL56485 弊社は信用調査会社様からの依頼に基づいて料金支払遅延者のデーターを一括管理しているDKC(データー管理センター)と申します。この度は貴殿が使用されたプロバイダー及び電話回線から接続された有料サイト利用料金について運営業者より利用料金支払遅延に関してブラックリスト掲載要請を受けました。これまで貴殿の利用料につきましてはコンテンツ事業者および債権回収業者が再三のご連絡を試みて来ましたが未だご入金がなくまた誠意ある回答も頂いておりません。以上のような理由から信用調査会社を経由して弊社に貴殿の個人情報を利用料金支払遅延者リスト(ブラックリスト)掲載要請が弊社に届きました。貴殿の情報に関しましては既にメールアドレス(フリーメール含む)およびIPから、プロバイダ・ISP業者から情報開示を受け、貴殿の住所、氏名、勤務先等の情報は判明しております。利用料金支払遅延者リスト(ブラックリスト)に掲載されますと、各種融資・クレジット契約・携帯電話の購入および機種交換他、貴殿の日常生活における信用情報に今後大きな支障が発生する可能性があります。付きましてはコンテンツ事業者および債権回収業者ならびに顧問法律事務所とも協議の結果、次ぎの通り最終和解案を決定いたしましたので通知いたします。合計支払金額：60000円 ~~~~~~~~~~~~~~~~~~~~~~~~ ■和解金: 50000円 ■事務手数料: 10000円 ===================== ■■合計金額: 60000円 --------------------- ■送付方法:電信為替(電信為替居宅払もしくは電信為替証書払) 今回の入金受付は郵便局の電信為替のみです。それ以外の方法では一切受付しておりません。 ■送付先:株式会社データー管理センター〒556-0016 大阪市浪速区元町2-8-4-404 ■担当:井上正孝 ■支払期限:上記宛に平成15年9月24日(水)必着で送付して下さい。電信為替の送付方法に関しましては http://www.yu-cho.japanpost.jp/s0000000/ssk00000.htm を参考にして下さい。詳しくはお近くの郵便局で確認して下さい。なお、郵便局で発生する送金手数料は貴殿の負担とさせて頂きますので御了承下さい。入金確認後、延滞情報リストから貴殿に関する全データーを削除し、株式会社データー管理センター保管の債権譲渡証明書、内容証明書等の書類一切を抹消させて頂きます。ご入金して頂けず、このまま放置されますと最終的に各地域の事務所から数名の集金担当員が御自宅および勤務先まで訪問をさせて頂きます。またその際に掛かります費用・調査費用・交通費等の雑費は別途回収手数料も合わせてご請求させて頂きます。また場合によっては裁判所を通じた法的手段にて強制執行による給料差押え等を含めあらゆる手段対で応させて頂く事となります。尚、これは最終的な勧告であり、また、弊社人員の対応による時間的損失等の理由からメール・電話・FAXでのお問い合わせは受け付けておりません。また、メールアドレス相違、郵便事故、その他いかなる事由により今まで連絡が取れなくなっていたにせよ、それは弊社に起因するものではなくお客様の責任によるものです。円満な解決を望むならば支払期限までに大至急入金をお願いします。 ※注意事項（１）管理番号で全ての管理を行っております。送金の際は氏名および管理番号の記載をお願い致します。 ※注意事項（２）本メールは送信専用アドレスより配信されています。このメールに返信されてもお返事は届きません。 ※注意事項（３）昨日までの時点でご入金の確認が取れない方にお送りしております。もし行き違いに入金済みの場合はご容赦下さい。 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 株式会社データー管理センター〒556-0016 大阪市浪速区元町2-8-4-404 担当:井上正孝 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

1 0

e10641427029847.15754166245
by lsh-list＠brennmeister.com 21 Sep '03

21 Sep '03

1 0

ANNOUNCE: lsh-1.4.3 and lsh-1.5.3
by nisse＠lysator.liu.se 20 Sep '03

20 Sep '03

All lsh versions prior to lsh-1.4.3, as well as lsh-1.5, lsh-1.5.1 and lsh-1.5.2, have a *buffer overrun* bug. This bug can lead to remote root compromise of the lshd daemon, and it can most likely also let a malicious server execute arbitrary code in the lsh client. And the affected code is run before either host or user autentication. The stable release lsh-1.4.3 and the development release lsh-1.5.3 both fix this bug, and two other bugs of similar character (but different consequences) which were found when greping the code for similar mistakes. All users of lsh and lshd should upgrade, and in case you can't upgrade lshd immediately, you are *strongly* advised to disable lshd service. Credit is due to Bennett Todd, who reported a crash which turned out to be a buffer overrun. Example exploit programs have been posted to the full-disclosure mailinglist. NEWS for lsh-1.4.3: Fixed heap buffer overrun with potential remote root compromise. Initial bug report by Bennett Todd. Fixed a similar bug in the check for channel number allocation failure in the handling of channel_open, and in the experimental client SRP code. Backported lshd setsid fix from lsh-1.5. Should call setsid both in the pty and non-pty cases. Updated the code to compile with automake-1.7.3 and scsh-0.6.0. The NEWS entry for lsh-1.5.3 is similar, but since it belongs to the development branch, it also contains some new experimental code, News for the 1.5.3 release Fixed heap buffer overrun with potential remote root compromise. Initial bug report by Bennett Todd. Fixed a similar bug in the check for channel number allocation failure in the handling of channel_open, and in the experimental client SRP code. lshd now has an experimental mode similar to telnet, where it accepts the 'none' authentication method and automatically disables services such as X and TCP forwarding. This can be useful in environment where it's required that /bin/login or some other program handle authentication and session setup (e.g. handle security contexts and so on). If you need a bug-fix-only update, you are advised to either stay with lsh-1.4.3, or apply the relevant three lines of the 1.4.3 patch, included below, to your 1.5.2 tree. The releases can be downloaded from http://www.lysator.liu.se/~nisse/archive/lsh-1.4.3.tar.gz http://www.lysator.liu.se/~nisse/archive/lsh-1.4.2-1.4.3.diff.gz http://www.lysator.liu.se/~nisse/archive/lsh-1.5.3.tar.gz ftp://ftp.lysator.liu.se/pub/security/lsh/lsh-1.4.3.tar.gz ftp://ftp.lysator.liu.se/pub/security/lsh/lsh-1.4.2-1.4.3.diff.gz ftp://ftp.lysator.liu.se/pub/security/lsh/lsh-1.5.3.tar.gz Regards, /Niels diff -urN lsh-1.4.2/src/channel_commands.c lsh-1.4.3/src/channel_commands.c --- lsh-1.4.2/src/channel_commands.c Thu Sep 27 08:29:44 2001 +++ lsh-1.4.3/src/channel_commands.c Fri Sep 19 14:15:37 2003 @@ -57,6 +57,7 @@ make_channel_open_exception( SSH_OPEN_RESOURCE_SHORTAGE, "Allocating a local channel number failed.")); + return; } channel = NEW_CHANNEL(self, connection, index, &request); diff -urN lsh-1.4.2/src/client_keyexchange.c lsh-1.4.3/src/client_keyexchange.c --- lsh-1.4.2/src/client_keyexchange.c Wed Mar 13 17:05:28 2002 +++ lsh-1.4.3/src/client_keyexchange.c Fri Sep 19 16:37:59 2003 @@ -268,6 +268,7 @@ { lsh_string_free(salt); disconnect_kex_failed(connection, "Bye"); + return; } mpz_init(x); @@ -282,8 +283,11 @@ mpz_clear(x); if (!response) - PROTOCOL_ERROR(connection->e, - "SRP failure: Invalid public value from server."); + { + PROTOCOL_ERROR(connection->e, + "SRP failure: Invalid public value from server."); + return; + } C_WRITE_NOW(connection, response); --- lsh-1.4.2/src/read_line.c Fri Aug 4 01:51:32 2000 +++ lsh-1.4.3/src/read_line.c Fri Sep 19 14:22:29 2003 @@ -98,6 +98,8 @@ /* Too long line */ EXCEPTION_RAISE(self->e, make_protocol_exception(0, "Line too long.")); + + return available; } /* Ok, now we have a line. Copy it into the buffer. */

2 1

lshd-1.5.2 bad crash
by Bennett Todd 19 Sep '03

19 Sep '03

on Red Hat 8, I can reliably crash lshd, shutting down all active sessions and leaving a pid file around so lshd refuses to restart, by running dd if=/dev/random bs=1024 count=1|nc localhost >/dev/null a few times. Sadly, capturing the random sequence that blows down an lshd and replaying it against another one doesn't seem to kill it; different running instances require different replays of the same random to kill them. Oh well, back to bloody openssh with all its bugs and patches. Drat! -Bennett

3 8

Working exploit for lsh 1.4.2
by Andreas Bogk 19 Sep '03

19 Sep '03

Hi! Haggis posted a working exploit for 1.4.2 on full-disclosure: http://lists.netsys.com/pipermail/full-disclosure/2003-September/010489.html I suggest an immediate release of a fix, and a security advisory. Andreas -- "The Board views the endemic use of PowerPoint briefing slides instead of technical papers as an illustration of the problematic methods of technical communication at NASA." -- Official report on the Columbia shuttle disaster.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

lsh-bugs September 2003