Attachment 678235 Details for Bug 894407 – Patch for CVE-2013-0176

[patch] Patch for CVE-2013-0176

0003-CVE-2013-0176-Fix-a-remote-DoS-if-the-client-doesn-t.patch (text/plain), 1.59 KB, created by Andreas Schneider on 2013-01-14 13:40:17 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andreas Schneider

Created: 2013-01-14 13:40:17 UTC

Size: 1.59 KB

patch

obsolete

>From 55b09f426417406bb25c0b9c474fbab1398b0dc8 Mon Sep 17 00:00:00 2001
>From: Andreas Schneider <asn@cryptomilk.org>
>Date: Wed, 9 Jan 2013 13:20:02 +0100
>Subject: [PATCH 3/3] CVE-2013-0176: Fix a remote DoS if the client doesn't
> send a matching kex.
>
>Thanks to Yong Chuan Koh, X-Force Research <kohyc@sg.ibm.com>
>---
> src/server.c | 13 +++++++++++--
> 1 file changed, 11 insertions(+), 2 deletions(-)
>
>diff --git a/src/server.c b/src/server.c
>index 131a2bc..b4fb189 100644
>--- a/src/server.c
>+++ b/src/server.c
>@@ -184,7 +184,11 @@ static int dh_handshake_server(ssh_session session) {
>       prv = session->rsa_key;
>       break;
>     default:
>-      prv = NULL;
>+      ssh_set_error(session,
>+                    SSH_FATAL,
>+                    "Could determine the specified hostkey");
>+      ssh_string_free(f);
>+      return -1;
>   }
> 
>   pub = publickey_from_privatekey(prv);
>@@ -270,6 +274,8 @@ static int dh_handshake_server(ssh_session session) {
>  */
> static void ssh_server_connection_callback(ssh_session session){
> 	int ssh1,ssh2;
>+    int rc;
>+
> 	enter_function();
> 	switch(session->session_state){
> 		case SSH_SESSION_STATE_NONE:
>@@ -338,7 +344,10 @@ static void ssh_server_connection_callback(ssh_session session){
> 		case SSH_SESSION_STATE_KEXINIT_RECEIVED:
> 			set_status(session,0.6f);
> 			ssh_list_kex(session, &session->client_kex); // log client kex
>-            crypt_set_algorithms_server(session);
>+            rc = crypt_set_algorithms_server(session);
>+            if (rc == SSH_ERROR) {
>+                goto error;
>+            }
> 			if (set_kex(session) < 0) {
> 				goto error;
> 			}
>-- 
>1.8.1
>

Actions: View | Diff

Attachments on bug 894407: 678235