DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org C30753858D34
MIME-Version: 1.0
References: <LV2PR19MB57671F587EAAF01EAB42666DE4A32 AT LV2PR19MB5767 DOT namprd19 DOT prod DOT outlook DOT com>
In-Reply-To: <LV2PR19MB57671F587EAAF01EAB42666DE4A32@LV2PR19MB5767.namprd19.prod.outlook.com>
Date: Wed, 17 Jul 2024 07:25:04 -0600
Message-ID: <CANV9t=RcpX8KCc-7krkLCGtxijXgmOFim3pExvz2tBnzTojLWw@mail.gmail.com>
Subject: Re: ssh vulnerability CVE-2024-6387
To: cygwin AT cygwin DOT com
UI-OutboundReport: notjunk:1;M01:P0:/g3j6TLdudE=;JYe2EOolV9/AR7c6CHvo9Asp562
 h24t03f+mIvJ/OeOSc9Rk5aQzebFa1f/hK/vze88nng+N/Pkvi2UbqETGVQr3iHnB95841x0U
 WDwny5YY8TNKejAS5/CK6Tql+tl0uLPUw2D3FpwXWsoan1/7ORrSZtFfkUcwnd2Jh2qXiyCtl
 rSpHRAPBOw+QIdlq54Gn1xFcmotO9pOFtmQBI0wIcA/zjH1OOnsWkKyHD5/Tv1lECQb6fCRBQ
 KVjvPKbIBxumnMYESgJHE3pt42SW16ElmXD2DePACMQC0GJ3t10Hy6Y8kqlxdl6xbHsRP7kj9
 AKc3a4jxuTQlJLZSrIFwj4rqoZE7LMOOlRefHKfwEbFzzhXQX2W3Koa0U+wysl2txvn73M7YM
 mrk6rQj7rSlBauQpSkH02v3egXBg8k4jMR3TkQ4Klnvhh+mdLh04N2ea4XkJhZlhPvZBPdCJ/
 h8V5WoXW21dvMcy/NZBbJa1p4MU5GbX5ALIIQveneW89nAlbF54gUcI0DuDRd7ql29g3Hr24d
 lmDkKgh3oaeglOjid5kevUrAPEgRHQ90exEYzRajA+JiZ5ypjaT2iIvOl5MYW6KaS9hOPfrIK
 uVjkL4fgMxOHMQV7GYTU+E3WfR/RqjNOPTPWNkeckOMQoxEizqeyd2PbCJSZAxY38jQbAuk6Z
 AmRr8W1O8gzYUiXa9y297dyR0zk5NF0KPR+/Fpp+pPbG2p4ASderzQso/r31rIfnU5eV9TfqM
 TR7sgEuGaB/Gn2i8dKUk4zhOKVHpuuMRRqcryqnBZR4HGhIzZuKca7GyGS5iB7xD1WWvbN9ud
 aemQUVFc/YLFcTPtWlQOysmA==
From: Bill Stewart via Cygwin <cygwin AT cygwin DOT com>
Reply-To: Bill Stewart <bstewart AT iname DOT com>
Content-Type: text/plain; charset="utf-8"
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com>
Content-Transfer-Encoding: 8bit

On Wed, Jul 17, 2024 at 6:25 AM Lemons, Terry via Cygwin wrote:

Vulnerability scanners run at my company have detected the following
> vulnerability in the Cygwin sshd:
>
> CVE-2024-6387    CVSS 3: 8.1
>
> OpenSSH could allow a remote attacker to execute arbitrary code on the
> system, caused by a signal handler race condition. By sending a specially
> crafted request, an attacker could exploit this vulnerability to execute
> arbitrary code with root privileges on glibc-based Linux systems.
>
> OpenSSH Vulnerability: CVE-2024-6387
>
>   *   Published: 07- 1-24 00:00
>   *   Diagnosis:
>
> A signal handler race condition was found in OpenSSH's server (sshd),
> where a client does not authenticate within LoginGraceTime seconds (120 by
> default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is
> called asynchronously. However, this signal handler calls various functions
> that are not async-signal-safe, for example, syslog().
>
>   *   Solution:
>
> Upgrade to the latest version of OpenSSH
>
> Download and apply the upgrade from:
> ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH
>
> The latest version of OpenSSH is 9.6.
>
> While you can always build OpenSSH from source, many platforms and
> distributions provide pre-built binary packages for OpenSSH. These
> pre-built packages are usually customized and optimized for a particular
> distribution, therefore we recommend that you use the packages if they are
> available for your operating system.
>
> Running SSH service
> Product OpenSSH exists -- OpenBSD OpenSSH 9.8
> Vulnerable version of product OpenSSH found -- OpenBSD OpenSSH 9.8
> Vulnerable version of OpenSSH detected on Microsoft Windows
>
> My Cygwin installation is using openssh 9.8p1-1 which, at this writing, is
> the latest available version.
>
> What are the plans to address this vulnerability in cygwin's openssh
> component?
>

I'm not sure I understand the concern. When I look at CVE-2024-6387[1], it
says version 9.8 (which you are running) is not affected.

[1] https://nvd.nist.gov/vuln/detail/CVE-2024-6387

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple