bugtraq - Re: OpenSSH/PAM timing attack allows remote users identification

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 2 May 2003 15:48:00 +0200 (CEST)
From: Marco Ivaldi <raptor@...iaservice.net>
To: Michael Shigorin <mike@...n.org.ua>
Subject: Re: OpenSSH/PAM timing attack allows remote users identification

On Fri, 2 May 2003, Michael Shigorin wrote:

> Are you talking of CURRENT branch?  4.x use linux-PAM as well.

Yeah, i was talking about FreeBSD-current, where OpenPAM has replaced
LinuxPAM, and new PAM modules have been introduced.

Speaking about FreeBSD 4.x, it doesn't seem to be vulnerable to the big
timing leak described in the advisory, even if doesn't uses the "nodelay"
option in /etc/pam.conf. I've not furtherly investigated this behaviour.

I believe, however, that all systems (FreeBSD included) are vulnerable to
many smaller timing leaks, and not only in OpenSSH. But i guess this is a
known problem.

--
Marco Ivaldi
Chief Security Officer    Data Security Division
@ Mediaservice.net Srl    http://mediaservice.net/