lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.43.0309161024120.28865-100000@tundra.winternet.com>
From: dufresne at winternet.com (Ron DuFresne)
Subject: new ssh exploit?

On Mon, 15 Sep 2003, christopher neitzert wrote:

> More on this;
>
> The systems in question are FreeBSD, RedHat, Gentoo, and Debian all
> running the latest versions of OpenSSH.
>
> The attack makes an enormous amount of ssh connections and attempts
> various offsets until it finds one that works permitting root login.
>
> I have received numerous messages from folks requesting anonymity or
> direct-off-list-reply confirming this exploit;
>
> The suggestions I have heard are:
>
> Turn off SSH and
>
> 1. upgrade to lsh.
>
> or
>
> 2. add explicit rules to your edge devices allowing ssh from only-known
> hosts.


This is perhaps the most workable and doable advise offered, the rest
sucks <smile>.

But, one has to remember ssh does not stand alone, at least openssh, it
needs openssl to be properly maintained as well.

Current openssh and old openssl can leave one hanging perhaps...

Thanks,

Ron DuFresne

>
> or
>
> 3. put ssh behind a VPN on RFC-1918 space.
>
> thanks.
>
>
>
>
> On Mon, 2003-09-15 at 12:02, christopher neitzert wrote:
> > Does anyone know of or have source related to a new, and unpublished ssh
> > exploit?  An ISP I work with has filtered all SSH connections due to
> > several root level incidents involving ssh. Any information is
> > appreciated.
> >
> >
> --
> Christopher Neitzert - GPG Key ID: 7DCC491B
>

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation." -- Johnny Hart
	***testing, only testing, and damn good at it too!***

OK, so you're a Ph.D.  Just don't touch anything.


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ