3 ms·

>Mitigate by using fail2ban? In theory, this could be used (much quicker than the mentioned days/weeks) to get local privilege escalation to root, if you alrea

• udev4096 2y ago
  How is local privilege escalation relevant here? Fail2ban should be able to block the RCE
  • mmsc 2y ago
    How is it not? If fail2ban isn't going to blocklist localhost, then it isn't a mitigation for this vulnerability because RCE implies LPE.
    • DEADMINCE 2y ago
      People are generally not trying to get root via an SSH RCE over localhost. That's going to be a pretty small sample of people that applies to. But, sure, in that case fail2ban won't mitigate, but that's pretty damn obviously implied. For 99% of people and situations, it will.
      • mmsc 2y ago
        >People are generally not trying to get root via an SSH RCE over localhost. That's going to be a pretty small sample of people that applies to It's going to apply to the amount of servers that an attacker has low-privileged access (think: www-data) and an unpatched sshd. Attackers don't care if it's an RCE or not: if a public sshd exploit can be used on a system with a Linux version without a public Linux LPE, it will be used. Being local also greatly increases the exploitability. Then consider the networks where port 22 is blocked from the internet but sshd is running in some internal network (or just locally for some reason).
        • DEADMINCE 2y ago
          > It's going to apply to the amount of servers that an attacker has low-privileged access (think: www-data) and an unpatched sshd. Right, which is almost none. www-data should be set to noshell 99% of the time. > or just locally for some reason). This is all that would be relevant, and this is also very rare.
          • infotogivenm 2y ago
            Think “illegitimate” access to www-data. It’s very common on linux pentests to need to privesc from some lower-privileged foothold (like a command injection in an httpd cgi script). Most linux servers run openssh. So yes I would expect this turns out to be a useful privesc in practice.
            • DEADMINCE 2y ago
              > Think “illegitimate” access to www-data. I get the point. My point was the example being given is less than 1% of affected cases. > It’s very common on linux pentests to need to privesc from some lower-privileged foothold Sure. Been doing pentests for 20+ years :) > So yes I would expect this turns out to be a useful privesc in practice. Nah.
              • infotogivenm 2y ago
                > Nah I don’t get it then… Do you never end up having to privesc in your pentests on linux systems? No doubt it depends on customer profile but I would guess personally on at least 25% of engagements in Linux environments I have had to find a local path to root.
                • DEADMINCE 2y ago
                  > Do you never end up having to privesc in your pentests on linux systems? Of course I do. I'm not saying privsec isn't useful, I'm saying the cases where you will ssh to localhost to get root are very rare. Maybe you test different environment or something, but on most corporate networks I test the linux machines are dev machines just used for compiling/testing and basically have shared passwords, or they're servers for webapps or something else where normal users most who have a windows machine won't have a shell account. If there's a server where I only have a local account and I'm trying to get root and it's running an ssh server vulnerable to this attack, of course I'd try it. I just don't expect to be in that situation any time soon, if ever.
      • remram 2y ago
        You could have also said "99% of people don't let their login timeout and hit the SIGALRM"... People don't usually use an SSH RCE because there usually isn't an SSH RCE. If there is, why wouldn't they? It doesn't matter if 99% of the situations you can think of are not problematic. If 1% is feasible and the attackers know about it, it's an attack vector.
• sgt 2y ago
  Confirmed - fail2ban doesn't block localhost.