Wind River Support Network

HomeDefectsLIN6-10283
Fixed

LIN6-10283 : Uninitialized struct field in the fix for CVE-2015-5600 causes random auth

Created: Aug 31, 2015    Updated: Dec 3, 2018
Resolved Date: Sep 15, 2015
Found In Version: 6.0.0.23
Fix Version: 6.0.0.25
Severity: Standard
Applicable for: Wind River Linux 6
Component/s: Userspace

Description

An uninitiated structure introduced by the fix from, introduces random authentication failures:

https://osdir.com/ml/ubuntu-bugs/2015-08/msg10633.html

Workaround

Index: openssh-5.9p1/auth2-chall.c
===================================================================
--- openssh-5.9p1.orig/auth2-chall.c	2015-08-17 17:25:47.942709117 +0000
+++ openssh-5.9p1/auth2-chall.c	2015-08-17 17:27:09.579844573 +0000
@@ -131,6 +131,7 @@
 	kbdintctxt->ctxt = NULL;
 	kbdintctxt->device = NULL;
 	kbdintctxt->nreq = 0;
+	kbdintctxt->devices_done = 0;
 
 	return kbdintctxt;
 }

Steps to Reproduce

-

Other Downloads


Live chat
Online