OpenSSH has a newly fixed pair of vulnerabilities, and while neither of them are lighting the Internet on fire, these are each fairly important.
The central observation made by the Qualsys Threat Research Unit (TRU) was that OpenSSH contains a code paradigm that could easily contain a logic bug. It’s similar to Apple’s infamous goto fail;
SSL vulnerability. The setup is this: An integer, r
, is initialized to a negative value, indicating a generic error code. Multiple functions are called, with r
often, but not always, set to the return value of each function. On success, that may set r
to 0 to indicate no error. And when one of those functions does fail, it often runs a goto:
statement that short-circuits the rest of the checks. At the end of this string of checks would be a return r;
statement, using the last value of r
as the result of the whole function.
Continue reading “This Week In Security: OpenSSH, JumbledPath, And RANsacked”