full-disclosure - **NEW** OpenSSH Vuln Today

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200309231311.40762.jeremiah@nur.net>
From: jeremiah at nur.net (Jeremiah Cornelius)
Subject: **NEW** OpenSSH Vuln Today

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

To:
Secure Shell

Subject:
Multiple PAM vulnerabilities in portable OpenSSH

Date:
Sep 23 2003 12:40PM

Author:
Damien Miller <djm cvs openbsd org>

Message-ID:
<200309231240.h8NCePCd025947@....openbsd.org>

Subject: Portable OpenSSH Security Advisory: sshpam.adv

This document can be found at:  http://www.openssh.com/txt/sshpam.adv

1. Versions affected:

        Portable OpenSSH versions 3.7p1 and 3.7.1p1 contain multiple
        vulnerabilities in the new PAM code. At least one of these bugs
        is remotely exploitable (under a non-standard configuration,
        with privsep disabled).

        The OpenBSD releases of OpenSSH do not contain this code and
        are not vulnerable. Older versions of portable OpenSSH are not
        vulnerable.

2. Solution:

        Upgrade to Portable OpenSSH 3.7.1p2 or disable PAM
        support ("UsePam no" in sshd_config).

        Due to complexity, inconsistencies in the specification and
        differences between vendors' PAM implementations we recommend
        that PAM be left disabled in sshd_config unless there is a need
        for its use. Sites only using public key or simple password
        authentication usually have little need to enable PAM support.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE/cKj6Ji2cv3XsiSARAgSXAKCnphtbWIwF2kxwYspPwcnQ2nC1HgCdFQqo
nFIlRMEGrI/7QvUcVCwYL7o=
=jsqb
-----END PGP SIGNATURE-----