Attachment 41141 Details for Bug 91593

log

log (text/plain), 16.97 KB, created by Marcus Meissner on 2005-07-05 11:45:58 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcus Meissner

Created: 2005-07-05 11:45:58 UTC

Size: 16.97 KB

patch

obsolete

>
>heimdal
>*******
>
>SUMMARY: PASSED/FAILED
>
>comment:
>
>it could not be reliably verified that the telnetd is still working
>
>presumably configured correctly both the telnet-telnetd combo and the ssh-sshd
>combo sometimes don't work (independent of architecture and product)
>
>nld-i386
>--------
>Update
>      before: heimdal-0.6.1rc3-55.15
>      after:  heimdal-0.6.1rc3-55.18
>      => PASSED
>
>      comment: (none)
>
>Tests
>      test1 (see below): Bug #91593 ("VUL-0: Heimdal telnetd buffer overflow in getterminaltype")
>      test2: PDB test cases 
>      => ???
>
>      comment: test case for telnetd did not work
>
>nld-x86_64
>----------
>Update
>      before: heimdal-0.6.1rc3-55.15
>      after:  heimdal-0.6.1rc3-55.18
>      => PASSED
>
>      comment: (none)
>
>Tests
>      test1 (see below): Bug #91593 ("VUL-0: Heimdal telnetd buffer overflow in getterminaltype")
>      test2: PDB test cases 
>      => PASSED
>
>      comment: (none)
>
>oes-i386
>--------
>Update
>      before: heimdal-0.6.1rc3-55.15
>      after:  heimdal-0.6.1rc3-55.18
>      => PASSED
>
>      comment:
>
>Tests
>      test1 (see below): Bug #91593 ("VUL-0: Heimdal telnetd buffer overflow in getterminaltype")
>      test2: PDB test cases 
>      => PASSED
>
>      comment: (none)
>
>slec-i386
>---------
>Update
>      before: heimdal-0.4e-409
>      after:  heimdal-0.4e-413
>      => PASSED
>
>      comment: (none)
>
>Tests
>      test1 (see below): Bug #91593 ("VUL-0: Heimdal telnetd buffer overflow in getterminaltype")
>      test2: PDB test cases 
>      => PASSED
>
>      comment: (none)
>
>sles8-i386
>----------
>Update
>      before: heimdal-0.4e-408
>      after:  heimdal-0.4e-412
>      => PASSED
>
>      comment: (none)
>
>Tests
>      test1 (see below): Bug #91593 ("VUL-0: Heimdal telnetd buffer overflow in getterminaltype")
>      test2: PDB test cases 
>      => ???
>
>      comment: test case for telnetd did not work
>      comment: test case for sshd did not work
>
>sles8-ia64
>----------
>Update
>      before: heimdal-0.4e-408
>      after:  heimdal-0.4e-413
>      => PASSED
>
>      comment: (none)
>
>Tests
>      test1 (see below): Bug #91593 ("VUL-0: Heimdal telnetd buffer overflow in getterminaltype")
>      test2: PDB test cases 
>      => PASSED
>
>      comment: test case for sshd did not work
>
>sles8-ppc
>---------
>Update
>      before: heimdal-0.4e-408
>      after: heimdal-0.4e-412
>      => PASSED
>
>      comment: (none)
>
>Tests
>      test1 (see below): Bug #91593 ("VUL-0: Heimdal telnetd buffer overflow in getterminaltype")
>      test2: PDB test cases 
>      => PASSED
>
>      comment: (none)
>
>sles8-s390
>----------
>Update
>      before: heimdal-0.4e-408
>      after:  heimdal-0.4e-413
>      => PASSED
>
>      comment: (none)
>
>Tests
>      test1 (see below): Bug #91593 ("VUL-0: Heimdal telnetd buffer overflow in getterminaltype")
>      test2: PDB test cases 
>      => ???
>
>      comment: test case for telnetd did not work
>
>sles8-s390x
>-----------
>Update
>      before: heimdal-0.4e-408
>      after:  heimdal-0.4e-413
>      => PASSED
>
>      comment: (none)
>
>Tests
>      test1 (see below): Bug #91593 ("VUL-0: Heimdal telnetd buffer overflow in getterminaltype")
>      test2: PDB test cases 
>      => PASSED
>
>      comment: test case for sshd did not work
>
>sles8-x86_64
>------------
>Update
>      before: heimdal-0.4e-408
>      after:  heimdal-0.4e-413
>      => PASSED
>
>      comment: (none)
>
>Tests
>      test1 (see below): Bug #91593 ("VUL-0: Heimdal telnetd buffer overflow in getterminaltype")
>      test2: PDB test cases 
>      => PASSED
>
>      comment: (none)
>
>sles9-i386
>----------
>Update
>      before: heimdal-0.6.1rc3-55.15
>      after:  heimdal-0.6.1rc3-55.18
>      => PASSED
>
>      comment: (none)
>
>Tests
>      test1 (see below): Bug #91593 ("VUL-0: Heimdal telnetd buffer overflow in getterminaltype")
>      test2: PDB test cases 
>      => ???
>
>      comment: test case for telnetd did not work
>
>sles9-ia64
>----------
>Update
>      before: heimdal-0.6.1rc3-55.15
>      after:  heimdal-0.6.1rc3-55.18
>      => PASSED
>
>      comment: (none)
>
>Tests
>      test1 (see below): Bug #91593 ("VUL-0: Heimdal telnetd buffer overflow in getterminaltype")
>      test2: PDB test cases 
>      => ???
>
>      comment: test case for telnetd did not work
>      comment: test case for sshd did not work
>
>sles9-ppc
>---------
>Update
>      before: heimdal-0.6.1rc3-55.15
>      after:  heimdal-0.6.1rc3-55.18
>      => PASSED
>
>      comment: (none)
>
>Tests
>      test1 (see below): Bug #91593 ("VUL-0: Heimdal telnetd buffer overflow in getterminaltype")
>      test2: PDB test cases 
>      => ???
>
>      comment: test case for telnetd did not work
>      comment: test case for sshd did not work
>
>sles9-s390
>----------
>Update
>      before: heimdal-0.6.1rc3-55.15
>      after:  heimdal-0.6.1rc3-55.18
>      => PASSED
>
>      comment: (none)
>
>Tests
>      test1 (see below): Bug #91593 ("VUL-0: Heimdal telnetd buffer overflow in getterminaltype")
>      test2: PDB test cases 
>      => ???
>
>      comment: test case for telnetd did not work
>      comment: test case for sshd did not work
>
>sles9-s390x
>-----------
>Update
>      before: heimdal-0.6.1rc3-55.15
>      after:  heimdal-0.6.1rc3-55.18
>      => PASSED
>
>      comment: (none)
>
>Tests
>      test1 (see below): Bug #91593 ("VUL-0: Heimdal telnetd buffer overflow in getterminaltype")
>      test2: PDB test cases 
>      => ???
>
>      comment: test case for telnetd did not work
>      comment: test case for sshd did not work
>
>sles9-x86_64
>------------
>Update
>      before: heimdal-0.6.1rc3-55.15
>      after:  heimdal-0.6.1rc3-55.18
>      => PASSED
>
>      comment: (none)
>
>Tests
>      test1 (see below): Bug #91593 ("VUL-0: Heimdal telnetd buffer overflow in getterminaltype")
>      test2: PDB test cases 
>      => PASSED
>
>      comment: (none)
>
>slox-i386
>---------
>Update
>      before: heimdal-0.4e-408
>      after:  heimdal-0.4e-412
>      => PASSED
>
>      comment: (none)
>
>Tests
>      test1 (see below): Bug #91593 ("VUL-0: Heimdal telnetd buffer overflow in getterminaltype")
>      test2: PDB test cases 
>      => PASSED
>
>      comment: test case for sshd did not work
>
>slss-i386
>---------
>Update
>      before: heimdal-0.4e-207
>      after:  heimdal-0.4e-412
>      => PASSED
>
>      comment: (none)
>
>Tests
>      test1 (see below): Bug #91593 ("VUL-0: Heimdal telnetd buffer overflow in getterminaltype")
>      test2: PDB test cases 
>      => ???
>
>      comment: test case for telnetd did not work
>      comment: test case for sshd did not work
>
>##############################################################################
>
>Bug #91593 ("VUL-0: Heimdal telnetd buffer overflow in getterminaltype"):
>-------------------------------------------------------------------------
>no exploit aviable!
>
>PDB test cases:
>---------------
>the pam tests do not work on SLES8
>
>OES update log
>--------------
>oes:~ # rug patch-info patch-10262
>
>Using patch-10262 10262 from the 'oestest' channel
>
>Name: patch-10262
>Version: 10262
>Installed: no
>Summary: undocumented patch for 7a1bd2904b1dafed2c6c5e32debc62d9
>Description:
>undocumented patch for 7a1bd2904b1dafed2c6c5e32debc62d9
>Patch-Date: 20050622
>pkglist: heimdal
>
>Description:
>A buffer overflow has been fixed in the kerberos telnetd daemon which
>could lead to a remote user executing code as root by overflowing
>a buffer.
>
>
>oes:~ # rug patch-install patch-10262
>
>Using patch-10262 10262 from the 'oestest' channel
>Download complete
>Transaction finished
>
>testcase for telnetd did not work on some products
>---------------------------------------------------
>
>SLES9:
>~~~~~~
>tux@sinope:~> klist
>Credentials cache: FILE:/tmp/krb5cc_32001
>        Principal: tux@test.suse.de
>
>  Issued           Expires          Principal                     
>Jul  1 10:44:35  Jul  1 20:44:35  krbtgt/test.suse.de@test.suse.de
>Jul  1 10:44:45  Jul  1 20:44:35  host/sinope.suse.de@test.suse.de
>
>tux@sinope:~> /usr/lib/heimdal/bin/telnet sinope.suse.de
>Trying 10.10.3.57...
>Connected to sinope.suse.de.
>Escape character is '^]'.
>Waiting for encryption to be negotiated...
>[ Trying mutual KERBEROS5 (host/sinope.suse.de@test.suse.de)... ]
>[ Kerberos V5 refuses authentication because Read req failed: Decrypt integrity check failed ]
>[ Trying KERBEROS5 (host/sinope.suse.de@test.suse.de)... ]
>[ Kerberos V5 refuses authentication because Read req failed: Decrypt integrity check failed ]
>
>Authentication negotation has failed,
>which is required for encryption.
>
>
>SLES8:
>~~~~~~
>tux@cancer:~> klist
>Credentials cache: FILE:/tmp/krb5cc_500
>        Principal: tux@test.suse.de
>
>  Issued           Expires          Principal                     
>Jul  1 14:35:27  Jul  2 00:35:27  krbtgt/test.suse.de@test.suse.de
>Jul  1 14:35:30  Jul  2 00:35:27  host/cancer.suse.de@test.suse.de
>tux@cancer:~> /usr/lib/heimdal/bin/telnet cancer.suse.de
>Trying 10.10.3.225...
>Connected to cancer.suse.de.
>Escape character is '^]'.
>[ Trying mutual KERBEROS5 (host/cancer.suse.de@test.suse.de)... ]
>[ Kerberos V5 refuses authentication because Read req failed: Decrypt integrity check failed ]
>[ Trying KERBEROS5 (host/cancer.suse.de@test.suse.de)... ]
>[ Kerberos V5 refuses authentication because Read req failed: Decrypt integrity check failed ]
>Welcome to SuSE SLES 8 (powered by UnitedLinux 1.0) (i586)\nKernel %r (%t).
>
>*** Connection not encrypted! Communication may be eavesdropped. ***
>User not authenticated. Using plaintext username and password
>login:
>...
>
>
>testcase for sshd did not work on some products
>-------------------------------------------------
>
>SLES9:
>~~~~~~
>tux@s390zvc19:~> klist
>Credentials cache: FILE:/tmp/krb5cc_1000
>        Principal: tux@test.suse.de
>
>  Issued           Expires          Principal                        
>Jul  1 12:23:21  Jul  1 22:23:21  krbtgt/test.suse.de@test.suse.de   
>Jul  1 12:23:35  Jul  1 22:23:21  host/s390zvc19.suse.de@test.suse.de
>
>tux@s390zvc19:~> ssh -v -2 s390zvc19.suse.de
>OpenSSH_3.8p1, SSH protocols 1.5/2.0, OpenSSL 0.9.7d 17 Mar 2004
>debug1: Reading configuration data /home/tux/.ssh/config
>debug1: Applying options for *
>debug1: Reading configuration data /etc/ssh/ssh_config
>debug1: Applying options for *
>debug1: Connecting to s390zvc19.suse.de [10.11.134.19] port 22.
>debug1: Connection established.
>debug1: identity file /home/tux/.ssh/id_rsa type -1
>debug1: identity file /home/tux/.ssh/id_dsa type -1
>debug1: Remote protocol version 1.99, remote software version OpenSSH_3.8p1
>debug1: match: OpenSSH_3.8p1 pat OpenSSH*
>debug1: Enabling compatibility mode for protocol 2.0
>debug1: Local version string SSH-2.0-OpenSSH_3.8p1
>debug1: SSH2_MSG_KEXINIT sent
>debug1: SSH2_MSG_KEXINIT received
>debug1: kex: server->client aes128-cbc hmac-md5 none
>debug1: kex: client->server aes128-cbc hmac-md5 none
>debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
>debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
>debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
>debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
>debug1: Host 's390zvc19.suse.de' is known and matches the RSA host key.
>debug1: Found key in /home/tux/.ssh/known_hosts:1
>debug1: ssh_rsa_verify: signature correct
>debug1: SSH2_MSG_NEWKEYS sent
>debug1: expecting SSH2_MSG_NEWKEYS
>debug1: SSH2_MSG_NEWKEYS received
>debug1: SSH2_MSG_SERVICE_REQUEST sent
>debug1: SSH2_MSG_SERVICE_ACCEPT received
>debug1: Authentications that can continue: publickey,gssapi-with-mic,keyboard-interactive
>debug1: Next authentication method: gssapi-with-mic
>debug1: Authentications that can continue: publickey,gssapi-with-mic,keyboard-interactive
>debug1: Next authentication method: publickey
>debug1: Trying private key: /home/tux/.ssh/id_rsa
>debug1: Trying private key: /home/tux/.ssh/id_dsa
>debug1: Next authentication method: keyboard-interactive
>Password: 
>debug1: Authentications that can continue: publickey,gssapi-with-mic,keyboard-interactive
>Password: 
>debug1: Authentications that can continue: publickey,gssapi-with-mic,keyboard-interactive
>Password: 
>debug1: Authentications that can continue: publickey,gssapi-with-mic,keyboard-interactive
>debug1: No more authentication methods to try.
>Permission denied (publickey,gssapi-with-mic,keyboard-interactive).
>
>tux@s390zvc19:~>
>
>
>SLES8:
>~~~~~~
>tux@cancer:~> klist
>Credentials cache: FILE:/tmp/krb5cc_500
>        Principal: tux@test.suse.de
>
>  Issued           Expires          Principal                     
>Jul  1 17:54:09  Jul  2 03:54:09  krbtgt/test.suse.de@test.suse.de
>Jul  1 17:54:13  Jul  2 03:54:09  host/cancer.suse.de@test.suse.de
>
>tux@cancer:~> ssh -2 cancer.suse.de -v
>OpenSSH_3.4p1, SSH protocols 1.5/2.0, OpenSSL 0x0090607f
>17208: debug1: Reading configuration data /home/tux/.ssh/config
>17208: debug1: Applying options for *
>17208: debug1: Reading configuration data /etc/ssh/ssh_config
>17208: debug1: Applying options for *
>17208: debug1: Rhosts Authentication disabled, originating port will not be trusted.
>17208: debug1: ssh_connect: needpriv 0
>17208: debug1: Connecting to cancer.suse.de [10.10.3.225] port 22.
>17208: debug1: Connection established.
>17208: debug1: identity file /home/tux/.ssh/id_rsa type -1
>17208: debug1: identity file /home/tux/.ssh/id_dsa type -1
>17208: debug1: Remote protocol version 1.99, remote software version OpenSSH_3.4p1
>17208: debug1: match: OpenSSH_3.4p1 pat OpenSSH*
>17208: Enabling compatibility mode for protocol 2.0
>17208: debug1: Local version string SSH-2.0-OpenSSH_3.4p1
>17208: debug1: SSH2_MSG_KEXINIT sent
>17208: debug1: SSH2_MSG_KEXINIT received
>17208: debug1: kex: server->client aes128-cbc hmac-md5 none
>17208: debug1: kex: client->server aes128-cbc hmac-md5 none
>17208: debug1: SSH2_MSG_KEX_DH_GEX_REQUEST sent
>17208: debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
>17208: debug1: dh_gen_key: priv key bits set: 142/256
>17208: debug1: bits set: 1618/3191
>17208: debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
>17208: debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
>17208: debug1: Host 'cancer.suse.de' is known and matches the RSA host key.
>17208: debug1: Found key in /home/tux/.ssh/known_hosts:2
>17208: debug1: bits set: 1621/3191
>17208: debug1: ssh_rsa_verify: signature correct
>17208: debug1: kex_derive_keys
>17208: debug1: newkeys: mode 1
>17208: debug1: SSH2_MSG_NEWKEYS sent
>17208: debug1: waiting for SSH2_MSG_NEWKEYS
>17208: debug1: newkeys: mode 0
>17208: debug1: SSH2_MSG_NEWKEYS received
>17208: debug1: done: ssh_kex2.
>17208: debug1: send SSH2_MSG_SERVICE_REQUEST
>17208: debug1: service_accept: ssh-userauth
>17208: debug1: got SSH2_MSG_SERVICE_ACCEPT
>17208: debug1: authentications that can continue: external-keyx,gssapi,publickey,password
>17208: debug1: next auth method to try is external-keyx
>17208: debug1: authentications that can continue: external-keyx,gssapi,publickey,password
>17208: debug1: next auth method to try is gssapi
>17208: debug1: authentications that can continue: external-keyx,gssapi,publickey,password
>17208: debug1: next auth method to try is publickey
>17208: debug1: try privkey: /home/tux/.ssh/id_rsa
>17208: debug1: try privkey: /home/tux/.ssh/id_dsa
>17208: debug1: next auth method to try is password
>tux@cancer.suse.de's password: 
>17208: debug1: authentications that can continue: external-keyx,gssapi,publickey,password
>17208: Permission denied, please try again.
>tux@cancer.suse.de's password: 
>17208: debug1: authentications that can continue: external-keyx,gssapi,publickey,password
>17208: Permission denied, please try again.
>tux@cancer.suse.de's password: 
>17208: debug1: authentications that can continue: external-keyx,gssapi,publickey,password
>17208: debug1: no more auth methods to try
>17208: Permission denied (external-keyx,gssapi,publickey,password).
>17208: debug1: Calling cleanup 0x8068040(0x0)
>
>another:
>
>tux@kallisto:~> klist
>Credentials cache: FILE:/tmp/krb5cc_32001
>        Principal: tux@test.suse.de
>
>  Issued           Expires          Principal                       
>Jul  1 08:58:01  Jul  1 18:58:01  krbtgt/test.suse.de@test.suse.de  
>Jul  1 08:58:16  Jul  1 18:58:01  host/kallisto.suse.de@test.suse.de
>
>tux@kallisto:~> ssh -v kallisto.suse.de -2
>OpenSSH_3.4p1, SSH protocols 1.5/2.0, OpenSSL 0x0090607f
>23366: debug1: Reading configuration data /home/tux/.ssh/config
>23366: debug1: Applying options for *
>23366: debug1: Reading configuration data /etc/ssh/ssh_config
>23366: debug1: Applying options for *
>23366: debug1: Rhosts Authentication disabled, originating port will not be trusted.
>23366: debug1: ssh_connect: needpriv 0
>23366: debug1: Connecting to kallisto.suse.de [2001:780:101:a00:230:6eff:fe1e:be17] port 22.
>23366: debug1: Connection established.
>23366: debug1: identity file /home/tux/.ssh/id_rsa type -1
>23366: debug1: identity file /home/tux/.ssh/id_dsa type -1
>23366: debug1: Remote protocol version 1.99, remote software version OpenSSH_3.4p1
>23366: debug1: match: OpenSSH_3.4p1 pat OpenSSH*
>23366: Enabling compatibility mode for protocol 2.0
>23366: debug1: Local version string SSH-2.0-OpenSSH_3.4p1
>23366: debug1: SSH2_MSG_KEXINIT sent
>23366: debug1: SSH2_MSG_KEXINIT received
>23366: debug1: kex: server->client aes128-cbc hmac-md5 none
>23366: debug1: kex: client->server aes128-cbc hmac-md5 none
>23366: debug1: dh_gen_key: priv key bits set: 118/256
>23366: debug1: bits set: 518/1024
>23366: debug1: Calling gss_init_sec_context
>23366: debug1: Delegating credentials
>23366: debug1: Received GSSAPI_COMPLETE
>23366: debug1: Calling gss_init_sec_context
>23366: debug1: Delegating credentials
>23366: debug1:  A token was invalid
>23366: debug1: Success
>23366: gss_init_context failed
>23366: debug1: Calling cleanup 0x400000000006f170(0x0)
>
>EOF

Actions: View

Attachments on bug 91593: 39580 | 41141