Author: delphij
Date: Thu Aug 10 06:59:43 2017
New Revision: 322344
URL: https://svnweb.freebsd.org/changeset/base/322344
Log:
Fix OpenSSH Denial of Service vulnerability. [SA-17:06]
Approved by: so
Modified:
releng/10.3/UPDATING
releng/10.3/crypto/openssh/auth-passwd.c
releng/10.3/sys/conf/newvers.sh
Modified: releng/10.3/UPDATING
==============================================================================
--- releng/10.3/UPDATING Thu Aug 10 06:59:26 2017 (r322343)
+++ releng/10.3/UPDATING Thu Aug 10 06:59:43 2017 (r322344)
@@ -16,6 +16,10 @@ from older versions of FreeBSD, try WITHOUT_CLANG to b
stable/10, and then rebuild without this option. The bootstrap process from
older version of current is a bit fragile.
+20170810 p21 FreeBSD-SA-17:06.openssh
+
+ Fix OpenSSH Denial of Service vulnerability. [SA-17:06]
+
20170712 p20 FreeBSD-SA-17:05.heimdal
FreeBSD-EN-17:06.hyperv
Modified: releng/10.3/crypto/openssh/auth-passwd.c
==============================================================================
--- releng/10.3/crypto/openssh/auth-passwd.c Thu Aug 10 06:59:26 2017
(r322343)
+++ releng/10.3/crypto/openssh/auth-passwd.c Thu Aug 10 06:59:43 2017
(r322344)
@@ -66,6 +66,8 @@ extern login_cap_t *lc;
#define DAY (24L * 60 * 60) /* 1 day in seconds */
#define TWO_WEEKS (2L * 7 * DAY) /* 2 weeks in seconds */
+#define MAX_PASSWORD_LEN 1024
+
void
disable_forwarding(void)
{
@@ -86,6 +88,9 @@ auth_password(Authctxt *authctxt, const char *password
#if defined(USE_SHADOW) && defined(HAS_SHADOW_EXPIRE)
static int expire_checked = 0;
#endif
+
+ if (strlen(password) > MAX_PASSWORD_LEN)
+ return 0;
#ifndef HAVE_CYGWIN
if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES)
Modified: releng/10.3/sys/conf/newvers.sh
==============================================================================
--- releng/10.3/sys/conf/newvers.sh Thu Aug 10 06:59:26 2017
(r322343)
+++ releng/10.3/sys/conf/newvers.sh Thu Aug 10 06:59:43 2017
(r322344)
@@ -32,7 +32,7 @@
TYPE="FreeBSD"
REVISION="10.3"
-BRANCH="RELEASE-p20"
+BRANCH="RELEASE-p21"
if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
BRANCH=${BRANCH_OVERRIDE}
fi
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
