full-disclosure - new ssh exploit?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20030915212338.GA67794@lightship.internal.homeport.org>
From: adam at homeport.org (Adam Shostack)
Subject: new ssh exploit?

Is privsep on in any of these systems?

Do the failed attempts show up in your logs?

And naturally, do you have some tcpdumps?

Adam

On Mon, Sep 15, 2003 at 01:48:34PM -0400, christopher neitzert wrote:
| More on this;
| 
| The systems in question are FreeBSD, RedHat, Gentoo, and Debian all
| running the latest versions of OpenSSH.
| 
| The attack makes an enormous amount of ssh connections and attempts
| various offsets until it finds one that works permitting root login.
| 
| I have received numerous messages from folks requesting anonymity or
| direct-off-list-reply confirming this exploit;
| 
| The suggestions I have heard are:
| 
| Turn off SSH and
| 
| 1. upgrade to lsh.
| 
| or
| 
| 2. add explicit rules to your edge devices allowing ssh from only-known
| hosts.
| 
| or
| 
| 3. put ssh behind a VPN on RFC-1918 space.
| 
| thanks.
| 
| 
| 
| 
| On Mon, 2003-09-15 at 12:02, christopher neitzert wrote:
| > Does anyone know of or have source related to a new, and unpublished ssh
| > exploit?  An ISP I work with has filtered all SSH connections due to
| > several root level incidents involving ssh. Any information is
| > appreciated.
| > 
| > 
| -- 
| Christopher Neitzert - GPG Key ID: 7DCC491B

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume