bugtraq - Re: rssh security announcement

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 9 May 2012 12:36:58 -0500
From: Derek Martin <code@...zashack.org>
To: Nico Kadel-Garcia <nkadel@...il.com>
Cc: bugtraq@...urityfocus.com, rssh-discuss@...ts.sourceforge.net
Subject: Re: rssh security announcement

On Tue, May 08, 2012 at 08:50:11PM -0400, Nico Kadel-Garcia wrote:
> Is  it still  a  problem  with  OpenSSH  version 6, which was
> recently published?

Yes.  The flaw is in how rssh parses command lines, irrespective of
what SSH implementation is used.  I've been a bit vague about the
details for the moment; I'm hoping that the announcement will generate
some interest in taking over the maintenance of the project.  I'd like
to have some sense of what will happen next before the full details
are disclosed.  If someone wants to step forward, it would be good to
give them a chance to fix it before that happens.

-- 
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D

Content of type "application/pgp-signature" skipped