equal
deleted
inserted
replaced
1 # |
|
2 # This is to fix a keyboard-interactive authentication brute force |
|
3 # vulnerability (MaxAuthTries bypass). A CVE number (CVE-2015-5600) has been |
|
4 # reserved for this problem, but not officially issued yet. This fix came from |
|
5 # OpenSSH upstream, which will be included in the future OpenSSH 7.0p1 release. |
|
6 # When we upgrade OpenSSH to 7.0 in the future, we will remove this patch. |
|
7 # |
|
8 --- orig/auth2-chall.c Fri Jul 24 17:36:37 2015 |
|
9 +++ new/auth2-chall.c Fri Jul 24 17:47:21 2015 |
|
10 @@ -83,6 +83,7 @@ |
|
11 void *ctxt; |
|
12 KbdintDevice *device; |
|
13 u_int nreq; |
|
14 + u_int devices_done; |
|
15 }; |
|
16 |
|
17 #ifdef USE_PAM |
|
18 @@ -169,11 +170,15 @@ |
|
19 if (len == 0) |
|
20 break; |
|
21 for (i = 0; devices[i]; i++) { |
|
22 - if (!auth2_method_allowed(authctxt, |
|
23 + if ((kbdintctxt->devices_done & (1 << i)) != 0 || |
|
24 + !auth2_method_allowed(authctxt, |
|
25 "keyboard-interactive", devices[i]->name)) |
|
26 continue; |
|
27 - if (strncmp(kbdintctxt->devices, devices[i]->name, len) == 0) |
|
28 + if (strncmp(kbdintctxt->devices, devices[i]->name, |
|
29 + len) == 0) { |
|
30 kbdintctxt->device = devices[i]; |
|
31 + kbdintctxt->devices_done |= 1 << i; |
|
32 + } |
|
33 } |
|
34 t = kbdintctxt->devices; |
|
35 kbdintctxt->devices = t[len] ? xstrdup(t+len+1) : NULL; |
|