OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: SSH & xauth
From: Brian Caswell (cazzRUFF.CS.JMU.EDU)
Date: Thu Feb 24 2000 - 16:31:35 CST


The default SSH configuration for SSH1 and SSH2 allow for remote
controlling of X sessions through X forwarding.

All children of the SSH connection are able to tunnel X11 sessions
through the X tunnel to the client X11 session. This is accomplished
by running xauth upon logging in.

If xauth is replaced on the server by a malicious program that does
both of the following:
 - runs xauth, adding in the "correct" information allowing the
   children of the session to tunnel X11 programs through the SSH
   session
 - runs xauth, adding in the "malicious" information, allowing a
   malicious source to tunnel X11 programs through the SSH session.

With the added data in .Xauthority, a malicious source can fully control
the client X session. The malicious source can then do most anything to
the X session, from logging keystrokes of the X session, to taking
screen captures, to typing in commands to open terminals.

The only thing that is required for the client system to be compromised
is for the client to remotely log via ssh (with X11 forwarding enabled)
into a compromised server.

Allowing X forwarding seems to be turned on by default in SSH1, SSH2,
and OpenSSH.

To fix this "issue" add the following lines to the SSH client
configuration. ($HOME/.ssh/config or ssh_config)

        Host *
          ForwardX11 no

Discussions of security flaws within X11 have been going on for years.
The "issue" in SSH X11 forwarding is not new. SSH has added to the
security of X11, but by no means does the use of SSH secure X11.

-- 
Brian Caswell <cazzruff.cs.jmu.edu>  
If I could load the world into vi, the first command I would use is:
%s/Windows NT//gi


  • application/pgp-signature attachment: stored