OpenSSH Local Root Hole

maelstrom writes: "Looks like someone's found a local root exploit for OpenSSH versions between 2.0 and 3.0.2. Seems as though its a one-off error, there is no public exploit, but there is sure to be one shortly. They aren't ruling out remote exploit. Recommending patching and upgrading ASAP."

Comments

There goes OpenBSDs slogan...

[psychofox]

I take it that their slogan "Four years without a remote hole in the default install!" will not being changed to "Five years without a remote hole in the default install!" then?

Shame...

Re:There goes OpenBSDs slogan...

[Chundra]

Ummmm, RTFP!

They aren't ruling out the possibility of a remote exploit.

Re:There goes OpenBSDs slogan...

[Chundra]

Everyone knows that to iterative over an array of n elements, you do this: for(i = 0; i arraySize) { error(); } else { ... }

Reeeeeeeeeeally? In what language?

How can someone like you have the nerve to criticize the OpenSSH guys?! Missing '<' and '>' in such a critical spot! Jeez! It might be a common error to make, but I would think people trying to illustrate the incompetance of a talented security software coder making a minor mistake would constantly be thinking to themselves about the consequences of these kinds of trivial syntactic errors. It's also a real bonehead mistake. Everyone knows that you use & lt ; and & gt ; in HTML to get the '<' and '>' symbols. I'm sorry if this sounds conceited (that isn't my intention) but when I look at this I have an almost subconscious SCREAMING reaction. For whatever reason, the days when I made mistakes like this have come and gone -- whenever I use '<' or '>' to illustrate how stupid someone else is (when they're trying to illustrate how stupid someone else is) I always think about it, and I cannot imagine someone not thinking about what they are doing. Especially in a piece like this. How completely, and totally embarrassing for you, Briosa.

I can't wait for djbssh

[Russ Nelson]

I can't wait for the Daniel J. Bernstein version of ssh.
-russ

Re:I can't wait for djbssh

[Anonymous Coward]

you mean the one that requires you to set up 3 accounts for the client, 3 accounts for the server, and comes with its own inetd replacement?

Re:I can't wait for djbssh

[biot]

It would be incompatible with the rest of the world's ssh implementations, of course, but I guess he'd write a DJB-RFC to take care of that.

Re:Full disclosure = annoying.

[Sarin]

Nah they don't.;) But I'm working on exploit code as we speak.

Yay!

[Anonymous Coward]

2002-03-07 11:39:40 Server version: SSH-2.0-OpenSSH_3.0.2p1

Good night everybody!

Re:smallest possible patch

[ghjm]

When a single missing '=' can cause a root exploit in code that's generally considered well-written, who are these people that actually entertain the idea that C is the right language to do coding in?

There are some reasons to use C for a project

[MrFredBloggs]

Phew! Thought i`d wasted the last 5 years of my professional life using the wrong language!

Visual Basic

[wiredog]

Has all the features any Modern Programmer could want. And it has the Highly Secure .net framework built in. What more could you want?

Re:Commercial SSH

[Anonymous Coward]

No
Professional software engineers wouldn't make such mistakes.

Re:OpenSSH site already updated?

[BlowCat]

Good thing that it's not a remote root exploit. Otherwise www.openbsd.org would now read:

Four days without a remote hole in the default install!

Not sure if OpenSSH is enabled by default though.

OpenSSH?

[Anonymous Coward]

When they said OpenSSH I didn't think they were so serious...