full-disclosure - OpenSSH again

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <56937.199.91.33.254.1064355158.squirrel@redrazor.net>
From: pdt at jackhammer.org (pdt@...khammer.org)
Subject: OpenSSH again

FWIW: A co-worker just forwarded information on to me that a "non-default"
configuration such as oh.... PAM is exploitable by being able to login as
any user with no password.  It affects the portable tree versions 3.7p1
and 3.7.1p1.

Has anybody seen exploit code on this one?

>
> Check out the webpage : ....-P2 :(
> Another bug :((
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>