full-disclosure - Re: [Rumor] SSH 0-day

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 8 Jul 2009 16:09:31 -0700
From: "frank^2" <frank2@...49.org>
To: Anderson Kaiser <alpkaiser@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: [Rumor] SSH 0-day

On Wed, Jul 8, 2009 at 1:58 PM, Anderson Kaiser<alpkaiser@...il.com> wrote:
> 2009/7/8 Martin Spinassi <martins.listz@...il.com>:
>> Hi list,
>>
>>
>> I've been reading around (openssh mailing list, some forums, etc.) a
>> rumor about a 0-day exploit in openssh. Does anybody knows if there is
>> *really* something like this in the wild?
>>
>>
>> Cheers
>>
>>
>> Martin
>>
>
> This attack sounds more like a brute-force attack than a 0-day. You
> can see it in the original post.

There's also the ominous anonymous comment left by a fellow on a blog:
http://isc.sans.org/diary.html?storyid=6742

The significant stuff: "Expect the SSH exploit to be made public
before BH/DC. I have proof that I can't share (sorry), that this
exploit does exist, does not work against current versions of SSH, and
is actively being used by members of the anti-sec movement."

Signs seem to be pointing to hoax, old exploit or non-exploit, though.
Unfortunately there's really not quite enough information to make an
assessment yet, IMHO.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/