full-disclosure - new ssh exploit?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20030916201009.GA12660@rahul.net>
From: bet at rahul.net (Bennett Todd)
Subject: new ssh exploit?

2003-09-16T15:55:07 Ron DuFresne:
> Don't see many posts from you these day Bennett, good to see
> you live <smile>.

It's gotten busy out, surely it has.

> Got a pointer?

Whenever I can't find some ssh implementation, I go shopping on the
"Alternatives" link section in www.openssh.com.

The lsh link there, <URL:http://www.net.lut.ac.uk/psst/>, seems
current and correct.

> I'd seek out myselfm, but have a huge project that's eating me up
> at present.

lsh has several library dependancies, so there's a little bit of go
back and back before it builds. So hold off looking at it until
you've got a little more time:-).

Once it does build, lshd is easy to get going, lsh takes a little
bit more fiddling --- its known_hosts facility is in a state of
flux, let us say.

> SSH and openssl is fast heading down the
> upgrade,patch,upgrade,patch scenerio of sendmail and wu_ftpd in
> the 90's.

This last one broke my camel's back. OpenSSH sshd begone. And so it
has. Cool!

> > It's ssh v2 only; I think that's a transition whose time has come.
> 
> This I will agree to fully, though, since we see the R* commands persist,
> and ftpd refuses to die, the list goes on.

Different constraints in different environments. I don't install ftp
servers, or rsh clients or servers, on my own systems. On other
systems, with external constraints forcing the use of such stuff, I
do the best I can. I'm a lot more concerned about the server side
than the client side, though.

Right now I wouldn't run an OpenSSH sshd exposed to the internet;
lshd is fine there. People who can't get sshv2 clients can go away.

I expect I'll be keeping around an OpenSSH ssh client for some time.

> Don't a number of appliances also use ssh1 and are not
> upgradeable?

Yup. Maybe some of 'em are vulnerable, too.

-Bennett
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030916/36eb92b5/attachment.bin