Slashdot Mirror
OpenSSH Vulnerability Disclosed, Version 3.4 Released
Dan writes: "OpenSSH 3.4 has been released and will be shortly available on all mirrors. All versions of OpenSSH's sshd between 2.9.9 and 3.3 contain an input validation error that can result in an integer overflow and privilege escalation. OpenSSH 3.4 fixes this bug." And kylus writes: "The previously mentioned vulnerability in OpenSSH has been disclosed by ISS X-Force today on the BugTraq list. This is a potential remote root compromise, and while there is a workaround, it's advised that users upgrade to version 3.4 as soon as they can."
Great news for Muslims.
0 02 Jun20.html
t ml
The United States Supreme Court has ruled that executing the mentally
retarded is unconstitutional.
Full Story..
www.washingtonpost.com/wp-dyn/articles/A16760-2
And more good news for Muslims.
Asteroid misses Mecca and Medina. Mother Nature when asked about the
near miss mentioned something about those that kill babies and "I don't
like that". Mother Nature is described as being 15ft. tall,
excruciating beautiful, eyes that can pierce one's soul, sparrows
nesting in her hair and absent of any islamic garb such as a burka.
Full Story..
www.spacedaily.com/news/020620121339.dc05vk7l.h
That's it.
see? that was funny, eh?
in Slashcode.
CLiT.
The
I claim this post to be UNCLAIMABLE BY THE CLIT
:-P
SUX0RS TO BE YOU! hehehehe
I Fart on your grave.
locate the "ChallengeResponseAuthentication" line in /etc/ssh/sshd_config (typically) change to :
"ChallengeResponseAuthentication no" and restart sshd
http://www.codewolf.com - Just good stuff to waste time
Does this mean I can submit MS bug fixes, and they'll get accepted?
The vulnerability is only for people who use OpenBSD going back to 2.8 and FreeBSD-current. Proof once again that if you want to secure your network use Linus
Does anyone know why it was kept so hush? It's so unlike the open source community to not just put it all right out there.
Overlooked thier deadly allies the CUNT!
Another victory for the CUNT squeezed from the hands of the AC's!
*THIS POST IS CLAIMED* I hereby claim this post in the name of the CLiT.
At least OpenBSD.org updated their web page.
typical - more insecure open sores. Thank God our country can rely on MS to do the right thing and increase the security of computing and networks for the majority of users.
15 people offering mirrors
49 people mentioning that Open Source security is indeed better than Closed Source security, and how this proves it
22 people talking about how stupid of a bug this is
6 people demonstrating how to exploit it
14 people making a funny comment about "apt-get"
9 people mentioning how they're using x.xx version because it's better and it's not afflicted by this bug
8 people claiming "Frost Pist" or somesuch 22 people shouting "Read the fucking article!"
"Mod, mod, mod...and another troll bites the dust."
SED Perl TCL C Ruby Assembler Java Java Slashdot TCL C Slashdot Wide Assembler PWP C TCL C C# Slashdot C++ VB VB Ruby Java Wide C# TCL Python Java Wide VB Wide Assembler Ruby AWK Java Delphi C++ Ruby Delphi Slashdot Perl TCL Python Wide SED SED Wide Wide Java Perl VB Ruby PWP C Delphi Ruby TCL Assembler Wide Ruby C++ C# SED Delphi SED TCL TCL Slashdot Perl C# Python Perl Ruby Ruby VB Ruby Delphi Wide Java Ruby C# Java Ruby TCL C# Ruby SED AWK Slashdot C++ Wide Delphi Ruby AWK Ruby VB Python VB TCL C# Delphi Wide Java C C# PWP VB Assembler Wide Ruby Wide C++ C Wide C Slashdot C++ Ruby Delphi AWK C# Assembler TCL C Perl Perl Delphi Delphi PWP Delphi C++ C AWK Assembler VB C Delphi AWK AWK C# Perl C Java AWK Ruby Ruby Wide C Python TCL Delphi Wide AWK Wide Wide Java C SED Wide VB Assembler Slashdot PWP PWP Python C++ Perl PWP Wide C Ruby C Wide SED VB Perl PWP Wide TCL VB Assembler SED Wide Ruby C++ Assembler C# Perl SED Java Python Wide C TCL SED SED C C Assembler Java VB C++ Perl Ruby Delphi Java Java Wide Java VB Wide C# C VB SED Perl Wide TCL Delphi C Python Ruby SED Python C AWK AWK AWK Wide TCL SED Ruby Assembler TCL AWK Delphi TCL C# VB Delphi PWP Perl VB Assembler C# SED Delphi Java SED Perl AWK C++ Perl Java Python Assembler C# AWK C C# Assembler C TCL C C# Slashdot C C Ruby VB Ruby C C++ SED Ruby Delphi Perl Ruby Wide VB Wide Assembler Assembler Assembler PWP Java Slashdot C++ Python Java Delphi AWK Java Java C PWP Ruby SED Wide Delphi TCL Delphi Slashdot Perl C++ AWK Delphi Perl VB VB VB Delphi TCL PWP Ruby Wide Ruby SED SED PWP VB VB C# Perl TCL AWK SED VB Python C++ C C++ C Assembler Perl Wide PWP Python C++ Perl Ruby Assembler PWP AWK Wide Ruby AWK Slashdot VB Python TCL C++ Slashdot Perl C++ Perl C++ SED Assembler C Perl Wide AWK SED AWK Wide Assembler Wide Wide AWK Assembler Java C++ Ruby Delphi VB VB VB Python TCL Wide Perl Delphi C++ Slashdot C++ Wide Perl Java C# Slashdot TCL Java Python Delphi C++ C C C C VB PWP AWK C++ Assembler VB VB Slashdot PWP Python Python VB C# SED C++ Perl C++ Delphi PWP Ruby C C++ Perl Java Wide SED SED AWK SED Delphi C++ C Wide Python Ruby C# C Delphi Ruby C++ PWP Slashdot AWK Delphi Perl Python Delphi PWP C VB Ruby C# Perl C++ Delphi C Wide Assembler Java PWP SED Python TCL PWP PWP C# Slashdot Slashdot PWP Assembler Java C Slashdot TCL Java SED C AWK Assembler Java SED Delphi Java Ruby C# Ruby Perl Delphi TCL Ruby PWP Python C++ Slashdot Delphi AWK TCL Slashdot VB Perl Java Slashdot TCL C Python C# Python AWK VB Assembler PWP Ruby Java Delphi Java Slashdot TCL C++ Java Ruby Slashdot Delphi Slashdot Slashdot Wide Perl Perl Slashdot C# PWP PWP Slashdot Java VB Ruby VB C C Ruby Wide TCL SED SED Slashdot Python Delphi Wide Python Delphi C Python C Delphi Assembler TCL Delphi Python VB C# C TCL PWP C# Python Wide Assembler PWP PWP Wide Delphi VB C# C++ C Java C Perl PWP Delphi VB Perl Ruby C++ C++ PWP Ruby Perl Delphi Delphi Ruby Python Java SED PWP Ruby VB VB Ruby PWP Assembler TCL VB Ruby TCL SED SED Slashdot C# VB Assembler Wide Perl Ruby Java Perl Ruby Ruby TCL SED C C# Java Ruby Ruby Perl Ruby TCL SED C Perl VB C VB Ruby Assembler Slashdot Ruby Assembler C++ Wide Python Delphi C++ VB Perl Perl C# Assembler Python Delphi Delphi Perl SED C++ Slashdot PWP Slashdot Perl Perl SED C C++ PWP Delphi Delphi Python Slashdot Java Assembler AWK Slashdot Python Ruby VB Wide TCL VB Delphi C Slashdot C# C++ Wide C# Slashdot Perl Python Assembler SED Slashdot SED C++ Python C++ C C Delphi Delphi AWK Slashdot AWK Slashdot C Python C VB Slashdot Python Delphi Java Perl Perl Perl Perl Wide Python Slashdot SED Assembler Python SED C TCL C Wide Perl Wide PWP Wide Wide Wide SED VB Ruby Assembler PWP Java TCL Ruby Slashdot Java Perl C# Java C++ Java Python Python TCL VB C# C C PWP C AWK Assembler TCL Slashdot TCL AWK SED Perl TCL Slashdot Ruby Java C# Python Delphi C SED Slashdot VB Ruby Java Ruby Slashdot VB Slashdot Wide Perl PWP Python VB C# Ruby Slashdot Perl Python C Perl PWP Java C# Python Slashdot SED SED C Perl AWK C# VB VB C++ Assembler PWP Ruby TCL Perl Delphi Slashdot C# AWK Python Delphi Python Java C Ruby Slashdot C# TCL TCL PWP Python Java Perl C++ VB SED VB Java VB AWK Python Delphi Perl Perl AWK Ruby VB Perl Assembler Assembler Delphi C++ Ruby Slashdot Slashdot Wide Python SED Java VB Delphi VB Ruby AWK SED Perl Delphi Python Python AWK Java Perl Ruby C Wide PWP Assembler Java Python Wide C# C Delphi C++ Python C# TCL Ruby C++ Assembler SED Python VB VB Slashdot TCL Assembler Python SED Perl TCL Assembler Perl Slashdot Wide C Slashdot Perl C++ SED Java Java Python AWK Assembler C++ Slashdot Delphi SED Java Assembler Python C# Wide Perl Wide Assembler Python PWP Delphi Java C Delphi Ruby C++ Wide Slashdot Java Assembler Delphi Python C++ Slashdot Python Java VB TCL PWP Delphi SED TCL Slashdot Perl Delphi Delphi Perl PWP Wide Assembler C AWK AWK AWK C# Perl VB VB Slashdot Slashdot Perl Ruby C++ Delphi Java Java Assembler C# Slashdot C# PWP SED Java VB Wide Assembler Delphi Delphi C++ Wide Java C# TCL Wide Assembler C# C Ruby Ruby C# PWP AWK TCL SED PWP VB Ruby C# C++ VB Python Slashdot Assembler TCL C# Python C# PWP VB VB Perl VB SED Perl Perl C++ VB Slashdot PWP AWK C Python Assembler C++ TCL Delphi Ruby Java C# Ruby Assembler PWP Slashdot Assembler SED Slashdot C++ VB AWK Python Perl Delphi SED C Delphi TCL AWK VB Wide C++ Perl Python AWK Wide Delphi C# VB Java PWP Ruby Wide TCL Delphi Perl SED Perl AWK Slashdot C SED C++ AWK Delphi PWP Ruby Python Wide VB Python Python Delphi Delphi PWP VB C++ C# AWK Wide C# VB TCL Java C++ C++ Ruby Java Perl C# TCL AWK AWK Java AWK Ruby AWK Perl Perl SED Slashdot Slashdot C++ SED SED Delphi Assembler Slashdot PWP Java AWK Python AWK VB Java Perl Delphi C# Delphi Python Slashdot Wide Perl AWK Assembler AWK C Ruby Delphi Wide Python AWK Wide Slashdot Python Wide Ruby Java Perl VB PWP Perl Java Assembler Python Slashdot Delphi Perl Python Delphi C PWP SED Python C++ Delphi C# SED Slashdot PWP C# PWP TCL Slashdot Ruby C# C Python Delphi C++ C++ TCL Wide Wide PWP Python Ruby TCL Java Slashdot TCL Python VB PWP Assembler Perl Python VB TCL Ruby VB C VB AWK VB Ruby AWK Delphi Delphi Slashdot Perl Perl PWP C++ Python Assembler C++ Wide C Slashdot Slashdot C++ Wide C PWP Ruby Perl PWP Delphi VB TCL Assembler TCL Wide VB Perl C++ SED TCL VB Wide Wide Assembler AWK PWP C# SED Assembler Ruby Python Ruby Wide VB AWK Python SED Ruby SED Delphi C++ C++ SED Slashdot Delphi Ruby VB Delphi VB Ruby C AWK SED C Python Wide TCL Wide C# Delphi TCL C# Assembler PWP AWK Python C++ Slashdot Perl TCL C# Perl Python Python AWK PWP Slashdot C++ C++ C# AWK C++ Perl SED Slashdot Ruby VB Delphi Slashdot C++ Wide C++ C++ SED Java Ruby Wide Ruby VB Perl Delphi SED Ruby Java C++ PWP Delphi Perl Perl Ruby TCL VB C# SED SED Wide Slashdot Python Assembler C# Delphi Ruby Assembler C Wide Python SED SED C++ C++ Ruby Wide Java C AWK AWK C# TCL PWP SED Perl VB VB AWK Ruby Ruby Wide Perl C# VB Java C# C++ C# TCL Perl TCL VB Wide C Slashdot C++ Python TCL Assembler C# Java PWP Assembler TCL C++ Java C Perl Java VB Wide Ruby Perl VB SED Ruby C# Perl TCL C# Slashdot SED Slashdot Java C# SED Assembler Ruby PWP C++ SED C# C# Python TCL Perl Ruby Wide Wide C Delphi Delphi Wide Slashdot VB Assembler C Wide C C++ VB VB C C# AWK Java PWP TCL TCL Delphi Slashdot PWP AWK Python PWP SED C Python Assembler AWK AWK Slashdot Delphi C# Ruby Java Perl Perl AWK Java Ruby Slashdot Slashdot C# C++ Delphi VB C++ PWP Assembler Ruby C# C C Perl Wide Perl Assembler Ruby Delphi Java TCL TCL AWK C++ Wide Assembler Delphi Wide Wide Ruby Python SED Assembler Delphi PWP Java Delphi SED C++ C# VB SED Java VB Ruby TCL VB SED C# C# C++ Ruby Ruby AWK PWP PWP C++ C++ Python C++ PWP SED C++ Python VB VB Python VB SED AWK C++ C TCL Ruby Ruby Ruby SED Perl C++ C++ C Java Delphi TCL SED Slashdot C# C++ C++ TCL PWP C# Assembler TCL Java SED Delphi VB Slashdot C Ruby Slashdot SED Wide Perl TCL Assembler C C++ Assembler C# VB VB SED C++ Python AWK Java Perl C# VB C++ Delphi Wide Delphi C# Java VB PWP Delphi C# Ruby SED C# Slashdot VB C++ Slashdot Slashdot Wide VB Wide Java TCL Wide Assembler TCL Ruby C Ruby Perl Assembler Ruby Python Java C Wide Python TCL VB Delphi C Slashdot C Python SED C++ VB PWP
As far as my servers.. 'DOH!'.
I got a customer at a bank that almost went to another webhosting provider because we ran linux, and he wanted something more 'Practicle'. His suggestion, Solaris. Well.. Whats that.. Sol9 shipped with OpenSSH? I see.. much more secure than our pathetic linux servers! Putz.
Its not the cost of the software, its how you admin it.
Can all fish swim?
Did any one of the many black hat groups out there actually work up a exploit or was this caught in time that it was just a possibility of being exploited?
Strange women lying in ponds distributing swords is no basis for a system of government.
"One remote hole in the default install, in nearly 6 years!" you can see it here: OpenBSD
~Shane
What you submitted appears below. If there is a mistake...well, you should have used the 'Preview' button!
"Mod, mod, mod...and another troll bites the dust."
Whether the source is open or closed, you're going to have something slip through all those lines of code.
The key here is that it is caught and corrected, and solutions offered.
I am the evil aardvark!
I'm impressed that the OpenSSH team gave us advance warning that this bug was going to be announced, and also how to reduce the risk (privilege separation).
From [openssh-unix-announce] Re: Upcoming OpenSSH vulnerability
I just finished upgrading to 3.3.1 on my Slackware box with privsep enabled. I heard that 3.4 wouldn't be out until next week Monday. Does anyone know if compression in sshd will work on GNU/Linux with 3.4?
...or does anyone else think that the way that this particular exploit was handled was, to say the least, irregular...
Personally, I'd go as far to say that I would rather switch to an alternative SSHd in the period that we were given from the presence of the exploit being announced to the fix being released - rather than following the "everyone upgrade now to our super-duper-improved privaledged seperated version"
It just seems to me that rather than attempting to help us users, the way that this bug was handled was just a huge PR stunt...
and I dont like it
fuck moderators, fuck trolls, fuck linux, fuck me, fuck you, fuck every fucking thing we do. fuck the police, fuck crime, fuck everything that wastes my fucking time. fuck the rain forest, fuck forrest gump, fuck the cripple with the leg like a fucking stump. fuck the queen, fuck the king, fuck ricky martin, the mother fucker can't sing. fuck michael jackson, fuck jackson browne, fuck the 2 cent hooker who's fucking going down. fuck flying, fuck walking, fuck talking, and just fuck stalking. fuck girls, fuck women, fuck every single living human being. fuck your mother, fuck your father, fuck cheap fucking soap that doesn't fucking lather. fuck the beatles, fuck the stones, fuck stupid fucking pagers, and mobile fucking phones. fuck the beach boys, fuck california girls, fuck eating vanilla ice cream with strawberry swirls. fuck nike, fuck reebok, fuck getting paid five bucks to suck an old man's cock. fuck mohammed ali, fuck ali baba, fuck the forty thieves, and fuck the dalai lama. fuck james bond, fuck 007, fuck 666, and fuck ever getting to heaven. fuck rollercoasters, fuck theme parks, fuck disneyland, and fuck being eaten alive by sharks. fuck driving, fuck cars, and fuck getting pissed in bars. fuck drinking, fuck smoking, fuck every fucking hippie who's out there toking. fuck saints, fuck sinners, fuck all the losers, and fuck all the winners. fuck fate, fuck karma, fuck luck, and fuck your girlfriend's momma. fuck god, fuck jesus, fuck the holy mary, and fuck your uncle cletus. fuck bottled water, fuck rain water, fuck the rain forest, and fuck your best friend's daughter. fuck computers, fuck the internet, fuck every dumb ass gambler who's ever placed a bet. fuck mini discs, fuck compact discs, fuck music, and fuck every singer, they me fucking sick. fuck alice, fuck wonderland, fuck tom petty and his shitty band. fuck the smashing pumpkins, fuck pumpkin pie, fuck every fucking star that twinkles in the fucking sky. fuck astronomy, fuck telescopes, fuck isotopes, and fuck the holy pope. fuck religion, fuck priests, fuck yeast infection, and fuck horny beasts. fuck premature ejaculation, fuck contraception, fuck viagra, and fuck getting constipation. fuck shitting, fuck eating, fuck food, and just fuck living. fuck hire purchase, fuck credit, fuck money, and fuck being in debt. fuck tom cruise, fuck cruise liners, fuck loose lips, and fuck sinking ships. fuck the titanic, fuck the marie celeste, fuck vapid bimbos, with silicone fucking breasts. fuck lip implants, fuck liposuctions, fuck cosmetic surgery, and fuck getting whipped in dungeons. fuck s&m, fuck leather boots, fuck the marquis de sade, and fuck every owl that hoots. fuck people with glasses, fuck bus passes, and fuck every single word that rhymes with asses. fuck poets, fuck writers, fuck critics, and fuck all the back biters. fuck chairs, fuck beds, fuck dying your hair, and fuck wearing dreds. fuck washing, fuck being clean, fuck steve mcqueen, and fuck blue windowlene. fuck roseanne bar, fuck jerry springer, fuck every women who put you through the ringer. fuck oprah, fuck ricki, fuck eating prawns, and fuck the evil tiki. fuck curses, fuck spells, fuck voodoo, and fuck wishing wells. fuck medicine, fuck being sick, fuck everything that makes us tick. fuck the television, fuck one vision, fuck mother theresa and her worthless mission. fuck ted danson, fuck charles manson, fuck marilyn monroe, and fuck marilyn manson. fuck garbage, fuck waste, fuck planning, and fuck doing things in haste. fuck underwear, fuck clothes, and fuck snorting coke up your nose. fuck south park, fuck your lucky penny, fuck murder, and fuck "oh my god they killed kenny". fuck bart simpson, fuck cartoons, fuck the weather, and fuck fucking monsoons. fuck getting wet, fuck staying dry, fuck every body when they ask you "why?". fuck eddie murphy, fuck murphy brown, fuck personalties, and fuck down town julie brown. fuck jackie brown, fuck james brown, fuck wife beating, and fuck krusty the clown. fuck tarantino, fuck robert deniro, fuck harvey keitel, and fuck danny devito. fuck movies, fuck videos, fuck dvd's, and fuck sucking cheesy toes. fuck blowjobs, fuck sex, fuck witches, and fuck getting a hex. fuck generation x, fuck malcolm x, fuck billy idol, and fuck eating tex mex. fuck mexicans, fuck beans, fuck burt reynolds, and all the other fucking has beens. fuck tattoos, fuck piercing, fuck drilling holes in your fucking ceiling. fuck spying, fuck peeping, fuck every fucking lemming leeping. fuck mini skirts, fuck garish shirts, fuck stupid ties, and fuck always getting hurt. fuck pain, fuck pleasure, fuck that bitch locklear who's first name is heather. fuck pamela anderson, fuck tommy lee, fuck porno videos, and fuck taking a pee. fuck dicks, fuck pussies, fuck tits, and fuck pee wee herman, he's a fucking wussie. fuck dictionaries, fuck thesaurus, fuck fred flinstone, and fuck his fucking brontasaurous. fuck wilma, fuck scooby doo, fuck panicking when you don't know what to do. fuck remaining calm, fuck staying in your seat, fuck diets, and fuck watching what you eat. fuck working out, fuck keeping fit, fuck jane fonda, and fuck giving a shit. fuck keeping skinny, fuck getting fat, fuck curiousity killing the fucking cat. fuck vegetables, fuck greens, fuck eating shit to keep yourself lean. fuck midgets, fuck giants, fuck the handicapped, and fuck the tyrants. fuck hitler, fuck mussilini, fuck italians, and fuck eating tortellini. fuck pizza, fuck the leaning tower, fuck disasters, and fuck taking a shower. fuck shoes, fuck feet, fuck farmers, and fuck growing wheat. fuck your haircut, fuck your look, fuck every fucking word that's in every book. fuck air freshener, fuck the ozone layer, fuck the irate whore when you don't pay her. fuck the army, fuck getting killed, fuck shaving your head, and fuck being unskilled. fuck cunnilingus, fuck your pubic hairs, fuck your bikini line, and fuck the fucking care bears. fuck orgasm, fuck g-spot, fuck every sex act that makes you fucking hot. fuck breathing, fuck air, fuck every fucking person who dares to stare. fuck ears, fuck eyes, fuck ever cheating on your wife. fuck monogamy, fuck mahogany, fuck antiques, and fuck coming crying to me. fuck tears, fuck laughter, fuck every dream you went after. fuck sleeping, fuck your pillow, fuck nursery rhymes, and fuck wind in the willows. fuck contact lenses, fuck your inhaler, fuck your crutch, and fuck the drunken sailor. fuck a buzzard, fuck the dukes of hazzard, fuck king arthur, and fuck merlin the wizard. fuck sting, fuck bees, fuck always falling on your knees. fuck girlfriends, fuck love, fuck peace, and fuck that fucking white dove. fuck star wars, fuck han solo, fuck yoda, and fuck riding a horse playing fucking polo. fuck the rich, fuck money, fuck working for a living, you fucking dummy. fuck stealing, fuck earning, fuck reading books, and fuck ever learning. fuck school, fuck your teacher, fuck clint eastwood, and fuck the stupid preacher. fuck dirty harry, fuck debbie harry, fuck blondie, and fuck ever wanting to marry. fuck modems, fuck printers, fuck shrivelled old age spinsters. fuck your heart, fuck your liver, fuck every broken mirror sliver. fuck bad luck, fuck seven years, fuck crying, and fuck salty tears. fuck backpacks, fuck bags, fuck sunglasses, and fuck limp wristed fags. fuck wallet chains, fuck keys, fuck everything your eyes ever see. fuck the sun, fuck the moon, fuck burt bacharach, and his lame fucking tunes. fuck austin powers, fuck the power rangers, fuck the lone ranger, fuck the lone gunman, and fuck conan the barbarian. fuck the kennedys, fuck jackie o, fuck jackie chan, fuck charlie chan, fuck charlie brown, fuck going brown, fuck tanning, fuck your skin, fuck cuts, fuck scars, fuck blood, and fuck getting shit to rhyme. fuck saying fuck, fuck swearing, fuck tourettes syndrome, and fuck the smile you're wearing. fuck nuns, fuck buns, fuck cakes, and fuck having fun. fuck your stereo, fuck your clock, fuck that movie scream, and fuck electric shock. fuck friends, fuck your family, fuck burger king's triple burger whammy. fuck anal probes, fuck intrusion, fuck head blows, and fuck getting contusions. fuck amnesia, fuck knowledge, fuck the shitty gardener, and your fucked up garden hedge. fuck dracula, fuck vampires, fuck biting necks, and fuck smoking funeral pyres. fuck cremation, fuck getting burned, fuck organ donation, and fuck howard stern. fuck coffins, fuck burial, fuck cheap ass sugary breakfast cereal. fuck coffee, fuck milk, fuck fine asian panties made of silk. fuck sausages, fuck meat, fuck pensioners, and fuck giving up your seat. fuck public transport, fuck trains, fuck your umbrella when it fucking rains. fuck coughs, fuck colds, fuck going into a home when you're old. fuck pea soup, fuck straws, fuck cheap girls with loose fucking drawers. fuck blacks, fuck whites, fuck political correctness, and fuck mr.buy rights. fuck martin lurther king, fuck dreaming, fuck your ambition, and fuck your scheming. fuck plans, fuck blue prints, fuck those shitty tasting after dinner mints. fuck restaurants, fuck eating out, fuck mcdonalds, and fuck getting candles in a blackout. fuck light, fuck dark, fuck taking moonlit walks in the park. fuck jon bon jovi, fuck new jersey, fuck liverpool, and fuck the stinking mersey. fuck dying early, fuck jimi hendrix, fuck jim morrison, 'cos they all just make me sick. fuck push up bras, fuck suspenders, fuck the flat nosed money lenders. fuck gangsters, fuck thieves, fuck sweeping up leaves. fuck trees, fuck wood, fuck plants, and fuck robin hood. fuck giving to the poor, fuck charity, fuck jane and her fucking calamity. fuck ike turner, fuck tina turner, fuck simply the best, and fuck that bunsen burner. fuck science, fuck chemistry, fuck everyone in the world but me. fuck charles bronson, fuck death wish 3, fuck revenge, and fuck sandra dee. fuck grease, fuck travolta, fuck every slimey bastard who lives in malta. fuck talk shows, fuck no shows, fuck every which way the wind blows. fuck fast, fuck slow, fuck wherever you may go. fuck masturbation, fuck self abuse, fuck stupidity, and fuck being obtuse. fuck cash, fuck jewellery, fuck david hassellhoff, and fuck the malibu sea. fuck life savers, fuck m&m's, fuck shitty rappers who make no ends. fuck uranus, fuck the eiffel tower, fuck getting caught in an april shower. fuck pets, fuck dogs, fuck cats, and fuck boss hog. fuck mid life crisis, fuck the swiss, fuck those little knives, and fuck every target you miss. fuck menopause, fuck women's lib, fuck eating with a baby's bib. fuck kids, fuck nappies, fuck high chairs, and fuck feeling crappy. fuck cindy crawford, fuck moles, fuck getting your dick stuck in tight holes. fuck the tellytubbies, fuck puppets, fuck kermit, the dumb fucking muppet. fuck the news, fuck politics, fuck puking up, and getting fucking sick. fuck liberals, fuck communists, fuck verbose movie plots with too many fucking twists. fuck toothpaste, fuck shower gel, fuck hair products, and shit that makes you smell. fuck std's, fuck crabs, fuck buying turkish sheesh kebabs. fuck what's real, fuck the fake, fuck blowing out the candles on your birthday cake. fuck holidays, fuck the easter bunny, fuck always running home to your mummy. fuck your runny nose, fuck your snot, fuck tying your cock in a knot. fuck dungeons and dragons, fuck role play, fuck ever getting laid in the hay. fuck homos, fuck straights, fuck standing in queues that make you wait. fuck eight items or less, fuck the trolley, fuck shirley temple and her fucking good ship lolly. fuck cults, fuck mass suicide, fuck swallowing pills of cyanide. fuck sheep, fuck goats, fuck wearing cashmere coats. fuck etheopians, fuck the starving, fuck cassius clay, and fuck lee marvin. fuck skulls, fuck bones, fuck william shatner, and fucking mortgage loans. fuck star trek, fuck ready brek, fuck falling down, and breaking your fucking neck. fuck the death star, fuck a star fucker, fuck a big fat greasy fucking trucker. fuck convoy, fuck the pokie, fuck the bandit and fuck on top of old smokey. fuck smokey robinson, fuck marvin gaye, fuck everything that I fucking say. fuck it all.
I suppose issues like this would prove Microsofts point that "open sorce" and "GPL'ed" software is something that cannot be trusted with mission critical applications.
All that you need to do, as far aas I understand it, is turn Challenge/Response authentication off (which nobody uses anyway). So the line in /etc/ssh/sshd_config reads:
and then restart the daemon.
Big deal.
I don't see any need to upgrade anything. Yes, privilege separation is nice in terms of future security, but I prefer the (more likely) known stability of software that has been in use for a while.
Debian security policy is that vulnerability fixes are backported (to avoid adding anything that could cause instability or further insecurity); this was made impossible by Theo's and ISS' advisory which lacked any details about the exploit. This may have been justified had the exploit not be able to be prevented by a simple configuration change (in order to give administrators time to prepare an upgrade their systems), but not for this.
Cheers, Theo, you just cried Wolf for the entire community. If there ever is a hole major enough that everyone should (or might want to) upgrade to a version which is by nature immune rather than give away the exploit by releasing a patch, noboby's going to believe you now, and probably not anyone else either.
Who are you to question our mighty lord and savior?
Theo Works in Mysterious Ways.
Well at least they are honest about it, and are trying to fix it. There's a company out here in redmond that could take lessons in honesty and security from them.
I notice that OpenBSD, which used to say something like "four years without a remote hole", now says "One remote hole in the default install, in nearly 6 years!" Don't know when it changed - would this be the "one", then? Anyone know?
Gobbles released a working "spl01t" on IRC some time ago. It's been circulating on private distro channels for some time.
Happy Turkey Day!
OpenBSD is insecure! It has a remote hole and it even ADMITS IT ON ITS WEBSITE Another thing, openbsd is crap, and even the openbsd project it self dosen't use it! It runs on solaris!
How does this authentication method work? I just disabled it, and I was still able to log in using my RSA keys and password authentication (which are the only methods I use). The documentation says it's for s/key authentication, but what is that? How common is this authentication method, and who would use it?
God Hates Trolls!
Don't use SSH. Switch to telnet instead....
ChallengeResponse... oh please! Telnet's never had these problems.
(note for the humour impared: this is a *joke*).
--
Garett
And so am I! But im an ANONYMOUS COWARD!
he's a stupid raping nigger.. cut off his fucking penis and balls..
now don't call me a racist.. i use the word nigger in reference to Chris Rock's definition
-robert turner
Okay, busy morning but glancing at the news, here's what I see:
There was a bug in the challenge/response code between 3.0-3.2.3. In fact, it's an "overflow" according the advisory. This means to me, it should be a fairly easy fix. Quote:
In addition, this overflow only works when SKEY and/or BSD_AUTH is enabled. But this seems to be "not enabled...in many distributions". How about Linux? However, OpenBSD has BSD_AUTH enabled (natch). Quote:
And now to add insult to injury, the 3.3 I installed yesterday has a new different buffer overflow, so I have to jump to 3.4 now (does it have any new bugs too?)
I don't like to jump versions on production machines. I like to fix what's running for minimum disturbance.
Can someone please explain why this vulnerability was handled this way? Why wasn't there a maintainance release that just fixed the @#$@#% problem?
I know: since the bug affected so many people, Theo thought it would be better to bury the problem in his privsep code, instead of fixing it and letting the blackhats run "diff" and find it for an easy 0-day-'sploit. In other words, security by obscurity, just like the big guys. That stinks, if you ask me.
On the other hand, I charge by the hour when I upgrade my client's machines. So thanks Theo! $-)
I wonder is Apple is going to release a minor OSX update for this. If they do, they prove themselves worthy supporters of OpenSource and creators of an OS that truly respects security.
If they don't, welll, they're still a 100 times more secure than 95% of the market
When will I end this grieving ? When will my future begin ?
Remeber, God Hates Trolls!
Gee, I don't sense the same cynical tone that you might see if this were a Microsoft product. I can't imagine that could have anything to do with bias on this site would it? NOoooo Not here. We just want the truth right?
SL33ZE - Artificial Intelligence is No Match For Natural Stupidity -
But have they fixed this bug??
This is a showstopper for me. Turning compression off does not solve the problem for me. I ended up using some patch off the mailing list temporarily.
Slashdot is like Playboy: I read it for the articles
He will be missed
Show me That Smile (The Growing Pains Theme Song):
Show me that smile again.
Ooh show me that smile.
Don't waste another minute on your crying.
We're nowhere near the end.
We're nowhere near.
The best is ready to begin.
As long as we got each other
We got the world
Sitting right in our hands.
Baby rain or shine;
All the time.
We got each other
Sharing the laughter and love.
Alan Thicke's Journal
My Slashdot ads say "
Does it even ship with OpenSSH installed? I'd be intrested to see if OS X is vulnerable - FreeBSD-STABLE isn't, so I wouldn't be surprised if OSX was using a pre 2.9.9 version.
Better loosen up that tinfoil hat there fella
Naaah, OSS has no security holes.
1. Tell you lot nothing, get the fix done and released (in which case you wouldn't have known about it until the fix came out).
2. Or tell you there is a bug, you can fix it temporarily by doing this until we get the fix out. In which case you decide either to follow him or do nothing (because after all, thats what you'd have been doing if nothing was said)
3. Or say, we have a bug, it's this and this and this is how you exploit it and then you lot all either scramble to install something else or sit around praying you don't get rooted whilst they compose a fix because now everyone and their dog know exactly how to exploit it.
Geeesh, be thankful he actually told you number 1. Next time, I think he should probably stick with number 2 and just tell you when the fix is out - at least then you can't whinge about it.
Avantslash - View Slashdot cleanly on your mobile phone.
Where are vendor statements that usually accompany such announcements?
Thankfully the default setup on SuSE 7.3 is "ChallengeResponseAuthentication no". Unfortunately, the default on Redhat 7.[0123] is "ChallengeResponseAuthentication yes".
"Naaah, OSS has no security holes."
According to my sshd configuration under Mandrake 8.0, this is already set to "n". In fact, the comment above the line makes things even more clear:
# Comment to enable s/key passwords or PAM interactive authentication
# NB. Neither of these are compiled in by default. Please read the
# notes in the sshd(8) manpage before enabling this on a PAM system.
ChallengeResponseAuthentication no
Once more unto the breach, dear friends, once more, Or close the wall up with our American dead!
Studies performed at the university of aquatic studies in hawaii have proven that in over eighty percent of patients that browsing slashdot at a threshold of -1 has been linked to severe cases of rectal cancers. Doctors suggest that people in high risk demographics seek help from a qualified health professional immediatly.
Go eat some cock you ass-stabbing linux zealot!
...if we still used telnet.
Je t'aime Stéphanie
Although it looks like Theo could have simply told everyone to disable challenge/response authentication, I'll venture to guess that he had a reason for not doing so. Consider that his original announcement was deliberately obscure, in order to avoid advertising the vulnerability to crackers, while vendors scrambled to patch their systems. If Theo had originally said "turn off challenge/response", all the crackers would immediately know where to look for the vulnerability, and the vendors would no longer have the head start they needed.
Here it is a few days later, the vendors have been given time to implement fixes, and we have disclosure. What are you people complaining about? Apart from the lack of social grace that he's famous for, I'd say Theo handled this about as securely as he could. Moreover, he did so by folloing the procedure widely accepted in the security community. Am I missing something?
Theo likes them young... real young...
More simple is usually more secure.
Smile on mighty Jesus.
Of course it was hidden. Open Source Zealots are hypocrites when it comes to stuff like this. Sure, anyone could have just "looked at the source" and discovered it, but they didn't want you to. By hiding the source in a sea of crap, they were able to get away with not revealing t he bug.
Assuming this is true for all RH7.3 boxen, there aren't hundreds of boxes waiting to be r00ted. It sounds from the comments like Debian is vulnerable - what about older RedHats, and other distros?
I get the feeling this was is a molehill made into a mountain.
DWR is Ajax for Java
IMO, this is the way ISS should have handled the Apache advisory...
I thought Open Source meant secure? You've all been lying to me, you bastards!
scott
CheckPasswords false
And then reboot your sshd.
Finally mail me, and I'll check that you really are safe. Oh and don't about slashdot users giving you bad advice you can be sure to only get accurate information here.
DWR is Ajax for Java
the openbsd website has been updated:
One remote hole in the default install, in nearly 6 years!
*sigh*
Fun while it lasted, I guess...
The Daily Build
anon ftp mirror of the rh7.3 rpms (and source rpm) here:
ftp://wingnut.beimborn.com
10k/sec cap, but they are small packages
DB
So, what do we know about who is affected? Immediately after reading the announcement, I checked Red Hat Linux's build of OpenSSH. The configure script positively reports that the affected authentication mechanisms are not available. 'ssh -v' does not indicate that challenge-response authentication methods are available either. I imagine that other Linux distros are similar?
RHL configure output:
OpenSSH has been configured with the following options:
...
Smartcard support: no
S/KEY support: no
BSD Auth support: no
This is not a troll/flamebait. Mods, keep your pants on.
/. running around like chickens with their heads cut off clammoring about how the person who found it should tell us what it is? The whole idea is that "many eyes ..." so why didn't we just go out and find it?
If OpenSSH is open source, and it is known that there *is* a hole in it, why are people on
How secure any software you're running on your system(s) depends on the quality of the code audit done on the code. I'm not judging the standard of the OpenSSH's team code audit here: things will slip through given the inherent complexity of software.
Privilege separation is a step in the right direction. By minimising the amount of code running as root, it makes code audits simpler and more through, and minimises the damage any potential exploit could do in the part running as a normal user.
Stepping back from the situation, privilege separation is just a bandaid for the lousy UNIX security model. Yes, granted, UNIX / Linux (i have no experience with other UNIX systems, so i shall reserve comment) have a security model that's used, as compared to Windows 9X. (Windows 2K has a security model, but the MS culture makes it difficult to administer it, but i digress). However, this security model is too coarse grained: it grants "root" too many privileges, too many rights. This is evident in the move towards ACLs, for example in NSA's SE Linux, as well as LIDS.
We need to overhaul the security model to one that's not prone to insecure software as much. Note I said as much:No system is 100% secure, and I don't want to replace my system with a toaster.
Appreciate feedback. Thanks. =)
Be kind. There are too many mean people out there already.
In my /etc/ssh/sshd_config:
:)
# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
This was on my Red Hat Linux 7.1 workstation (also acts like a private server only to me). Do I assume this is at no value right now and I don't need to worry?
Thank you in advance.
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
Stupid security holes.
Theo DeRaadt's code writing ability resembles a chunk of swiss cheese that has been blasted a few times with some shotgun rounds.
And this NASTY HOLE keeps getting ignored, but the OpenSSH team continues to fix others.
Screw this -- I'm going commercial UNiX.
Each time I see a vulnerability report about OpenSSH, I wonder whether the vulnerability is also present in plain SSH. Finland's site doesn't seem to have any information on security advisories, at least not in any obvious place.
Is there a page anywhere that summarizes the holes/bugs/exploits in OpenSSH discovered in the last, say, two years? year? six months?
- undoware.ca
The 3.3 release of OpenSSH required that with PrivilegeSeparation turned on, Compression had to be turned off for Linux kernels in the 2.2 line. Does anyone know if this is true for the 3.4 release as well, or has that been fixed?
Al Qaeda has ninjas!
A while back Don Henley created an album called Building the Perfect Beast His first solo album it surprised many with tracks like Sunset Grill All She Wants To Do Is Dance my favorite Driving With Your Eyes Closed and Jon Katzs favorite Boys of Summer I was listening to this album on illegallyripped MP3s while reading the Slashdot trolls and started brainstorming what would make the perfect troll This article serves as a directed introduction to building the perfect trollFirst we need to define trolling This is harder than it sounds because everyone has their own definition of a troll or better their own definition of a good troll I am going to use multiple definitions to create a very broad ideal of the term troll Any post that meets ONE of the definitions below is considered a trolla A message widely regarded as an annoyanceb A message which insults the editors with no regard to meritc A message which flames another user for their viewsd Any message which is designed to enrage the standard slashdot userFor the purposes of this post a good troll is one that spawns many angry responses There are other sides of trolling such as crapflooding which do not generate any responses usually These sorts of trolls are out of the scope of this articleThere are 6 dimensions of a good troll annoyance arguability subtlety topicality logicality and permeance By NO means should a good troll use only one dimension although some dimensions are inherently contradictory using as many as possible will result in a good trollAnnoyanceThis is the allstar of the troll spectrum Racial comments page wideninglengthing misinformation deragatory comments etc all are considered an annoyance But be careful The common pitfall is the annoyance is used to frequently and too loudly Subtlety is a necessity if you are going to use this with any sort of success read more about this below Here are some examples of good and bad annoyancesBad You stupid fucking nigger Im going to kick your faggot ass if I ever see you you shitface cocksucking animal This will be modded down immediately and will probably not be responded to This message will largely be ignored thus limiting the troll affectPosting factual inaccuracies is great when combined with annoyance the Slashdots will fall over themselves correcting your every moveGood Its posts like these that question the education system of America If you were paying any attention at school you would know that the South won the Civil War because of their views no slavery It was Abraham Lincolns last stand at Gettysburg that caused Slavery to go awayMaking references to your education as proof that you are right is excellent especially when in your troll you make it obvious that you dont have anyBad I studied this topic in great depth when writing my PhD thesis at MIT As it turns out the limiting factor of sorting function with completely randomized data Good Oh I took a class about this at the DeVry Institute According to the reseptionist notice intentionally bad spelling the integral of ex2 is ex so its got to be rightArguabilityPosts such as You fucking faggot Im going to kill you has no element of arguability You want to post a view in an inflammatory way that will incite a great argument There is a right way and a wrong way to doing this Usually if you are outright cursing at the poster or editor its the wrong wayExamplesBad You worthless piece of horseshit Your views are wrong jackassGood This study post link to mostly irrelevant and offtopic study indicates there is a strong correlation between deviance and Linux usersDrawing illogical conclusions based on incorrect statements is a great way to instate a nerd riot ExampleGood When ESR said that Windows is losing clientelle he used intentionally bad grammar which is inherent proof that his ideals are flawedPermeanceQuestion If a troll posts a troll and no one reads it is it still a troll Answer NoA troll can only have so much longevity I call this principle permeance Permeance is judged by the number of people who will see and read a post and to a lesser extent respond to it Good formatting grammar and spelling all contribute to a posts permeance but the real factor is contentMost of you spend a lot of time reading at 1 presumably so you will know that a fair amount of racist and antisemetic comments are posted Most Slashdot users will not see these because they are at 1 klercks PLP and PWP are ultimately a failure because few see themTo maximize permeance you have to 1 Sound like you now what you are talking about 2 Sound like you have a stake in your point of view maening you care about what you think and 3 Express it without homophobia any sort of racism and discrimination You will see that trolls at 1 and even 2 use this principle You will see that trolls at 0 and 1 do not use this principle This brings us toFirst Fundamental Theorem of Trolling Anonymous Cowards by definition rarely succeed in posting a good trollSecond Fundamental Theorem of Trolling If an AC succeeds in a good troll it would even be better if it were posted at 1 or 2 by default SubtletyCertain posts SCREAM This is a troll Please ignore it These are not successful trolls As a troll your every urge is to scream YOU FUCKING FAGGOT HOW CAN YOU THINK THE WAY YOU DO to the Slashbot homos Resist this at every cost You need to diplomatically insult them Its hard I know but it will result in success GOOD PHRASESYou should know by now that Havent you learned anything from eventWhat a stereotypical viewWas this post sarcasticI cant believe the level of ignorance of that point of viewTopicalityThis is a nobrainer and therefore Im not going to spend much time discussing it Why do you think BSD is Dying trolls rarely get responses when they are posted under one of Jon Katzs articlesLogicalityDid I make that word up Probably But its principle is still important use every logical fallacy that you know of when writing trolls Jump to illogical conclusions Misquote or misrepresent parents posts when responding Make references to studies linking them to a 404 not found page You get the idea This one isnt hard to introduce but its wildly successful in getting Slashcock responsesThis is a brief introduction to the good trolling Soon I will post an article about combining dimensions and look at some good and bad trolls in the past
-pwpbot
There was a simple workaround in the config file and they made people waste time f*cking about with that messy new version. It's all about politics and ISS milking it for publicity.
Nice advert for not using open source s/w, your at the mercy of idiots, I was converted one way a few years back, now im advising people to steer well clear.
I discovered after downloading and building 3.4p1 on my Solaris 7 box that Solaris doesn't support a shared memory feature 3.4's privilege separation uses. As a result, you can enable privilege separation or compression, but not both at the same time. Just something to be aware of if you're considering an upgrade. (It's possible more recent versions of Solaris don't have this problem.)
(See subject.)
that you have to say in your post.... (this is a joke)
/. for as long as I have, I guess that it's true, some people are just humor impared.
But, after reading
Maybe if people stopped programming in
C they wouldn't keep having integer overflow
and buffer overflow bugs. This has been a solved
problem in Lisp forever.
Even Java has integer overflow, the C weenies never really learn to part with their old ways.
I use stunnel and telnet (plus mandatory ssl certs - so even though telnetd might have a bug, you can't exploit it without a valid cert).
Years ago I took a look at ssh and thought it would have lots of problems (kludgy, lots of complex features stuffed into one binary). The "Sendmail" of remote admin.
The past years have vindicated my decision many times over.
Sure stunnel and openssl have had some problems too, but as long as the stunnel people don't try to stuff tons of features in, it'll still be much better than ssh securitywise.
You could try vnc over stunnel if you really need GUIs.
Cheerio,
Link.
I can't wait until djb decides to write his own ssh. You can say what you want about djb and his personality, but he does know how to write some secure software. Sure, it's not the easiest thing to install and you have to create a boatload of users, but privilege separation has been in qmail since 1.0.0. Theo is getting around to it in v3.3? Never heard of any root compromises from qmail or djbdns. So hopefully this latest hole in OpenSSH has annoyed djb to the point of rolling his own.
if you don't need all the features of SSH, try telnet+SSL+certs
It's likely to be safer.
I've been using stunnel+telnet for years and I have had to patch/upgrade a lot fewer times than people using SSH.
Cheerio,
Link.
Not true. My RH 7.2 and 7.3 systems default to "no". In fact, you can't set it to yes because support isn't even compiled in.
My complaint is that they forced everyone to upgrade to 3.3 (which is by all accounts largely untested) to workaround this problem when all that was needed was to set a single option to no in the config file.
I certainly would have preferred to do that to upgrading to an untested version of software.
There are crackers out there and it is important to keep up with security advisories. I just have to check my Apache logs to see attempts to exploit old IIS bugs. My system logs show the occasional attempt to hit SSH as well.
Of course I use ipchains and tcpwrappers so I don't worry too much about SSH exploits but I still make the effort to keep up.
A dyslexic man walks into a bra.
This is one of the first times I've seen someone in the open-source community try to use fear-uncertainty-doubt to get their user base to upgrade whether they need to or not. It turns out, that for all Theo de Raadt's sense of urgency that everyone should upgrade, we're not vulnerable at all where I work, because we disable auth mechanisms that we are not using. I tend to believe that Theo knew that this would effect less than half of the ssh community. Even for most of us with it compiled in, there is a one-line workaround that could be deployed much more quickly than a new version. While the new privilage separation code sounds like a really good idea. Still, to me the whole drama seems like an attempt to provoke the whole community to upgrading when they really didn't need to.
So much for the "many eyes, open source, no bugs" theory. And what's with they delayed announcement? Open-source taking a few clues from the Dark Side?
I probably upgrade OpenSSH more than any other service on my systems. How in the fsck am I supposed to keep up with this in a production environment? What does the frequency of bug release indicate about the 'thorough' coding practices over at the OpenBSD group? I'm not trolling - just asking what I consider to be legitimate questions.
No offense intended but this looks like an attempt to take rubes (the poster's 26+ karma notwithstanding.
Linux is Linux, if One need clarify their dist: <Dist>/GNU Linux
bsds are of course just BSD
There was a clean work-around and they didnt post it.
I manage 5 systems here. One was hardened by bastille linux. On that system, it was already set to ChallengeResponseAuthentication no.
So I think the bastille scripts fixed the setting.
My SSH config on Red Hat 7.2 has exactly the same comment and setting you quoted, with challenge/response set to no. I can't remember now how I installed SSHD originally, though, i.e. whether I downloaded a newer version or used the one on the Red Hat CDs.
I'm going back to telnetd and blind optimism.
jack's bicycle is music to my ears
Warning goatsex link
start here
Meaning this brouhaha, of course...
Just to combat some of the misinformation that has been spreading around here:
Don't complain too much folks... you could have to do without a robust free ssh implementation.
The difference here is:
1) The problem was fixed in a couple of days
2) The upgrade was free
3) This is the first serious security hole OpenBSD has had in nearly 6 years.
For extra credit, compute the following: average number of days between disclosure and fix, times the cost of the upgrade that gives it to you, times the number of remote-root-level security exploits in your average BorgOS over 6 years.
At least mafia-owned pizzarias make excellent pizza. Compare to Bill Gates.
Monday, June 24, 2002 11:22 PM
There is an upcoming OpenSSH vulnerability that we're working on with ISS.
Details will be published early next week.
....etc etc etc
Now ISS has up'd the ante and released it justa day and a half later. 1 and 1/2 days isn't a lot to verify that a production environment will not be adversely effected byANY new/changed element. So it would seem that "working with ISS on this issue"is synonymous"we are waiting to get blindsided". This also leads into another interesting issue. Why did ISS's reckless announcement take minutes to get through bugtraq and the OpenSSH's initial, responsible warning take 24+ hours to process? I can plainly see that Theo's letter was sent on Monday but for some reason only gets here today. I know that SMTP mail is slow..but I don't thinkmy server isTHAT slow. Fortunately, it showed up on the vuln-watch list as well and we were able to help spread the word.
> X-Force is aware of active exploit development forthis vulnerability.
I don't know if I really even believe you on this certainlyyour recent actions are not that of a company that seeks to garner trust. Of course the minute anyone suggests there is a problem with product XYZ, thousands of bored people are going to start poking around "actively" trying to develop an exploit! But blind testing from scratch would certainly have taken longer than the proposed "quiet week" before publishing details.So, lets suppose it was a more informed testing. So who knew enough about this to let it out? ISS and the OpenSSH dev team. One is made up of hard working developers who love aprogram enough give their time away to make a really great product. The other is composed of people who routinely socialize with the underground "active exploit development" community. In my opinion, at least one side would have absolutelyno motive leak their information. So I propose: A: Your analysis of the exploit development process was faulty B: there was no active development for an exploit, and you released the info for your own good.C. Someone's teamis leaking information.
In any event, there no need for any furtherunderground exploit "R&D"; everyone now has the diff blueprints to get directly to the end goal. Granted, there are people out there intelligent enough totake the time find the issue and to code an exploit without this knowledge. But these type of people wouldn't likely release it to the general populace, instead it would be used for select targets. Targets that would most likely already have security teams in placeand be up on warnings and patches. Instead we have a patch diffs in the hands of everybody and now lower skilled programmers can code the exploit. These people will spread the exploit far and wide simply for fame; only this time the targets will be everyone.
No one wins with this route you have chosen ISS. You and your X-force team used to be a respected group in my book. In the past they have provided valuable information to the security community and helped companies across the world to better secure themselves, but the handling of this and the Apache vulnerabilities are shining examples of how NOT to do things. So much for ISS being a "Trusted" center of knowledge. Trust and honor are coins you can only spend once.
Nelson Bunker, CISSP VP of Security Critical Watch The opinions expressed in this advisory and program are my own and not of any company. The big print giveth, the little print taketh awaywell, it does have the source rpm, so I guess you could audit it. It would be nice to have the md5sums, though. I'm guessing the author is trying to be nice in building an rpm.spec from the source, and also including some binary builds for RH 7.3
...rather than rebuilding. Generating new RPMs for 6.2 is a total nightmare.
"I thank the Debian team, OpenBSD/OpenSSH teams, Wietse Venema and the rest of the Postfix hackers, the mailman team, the GNU project, all the Linux kernel hackers, and anybody else who has contributed free software that I rely on to do my job for making my job as a sysadmin smoother than it might otherwise be."
That's something that could be said more often.
From announce@openbsd.org:
"
This is the 2nd revision of the Advisory.
1. Versions affected:
Serveral versions of OpenSSH's sshd between 2.3.1 and 3.3
contain an input validation error that can result in an
integer overflow and privilege escalation.
All versions between 2.3.1 and 3.3 contain a bug in the
PAMAuthenticationViaKbdInt code.
All versions between 2.9.9 and 3.3 contain a bug in the
ChallengeResponseAuthentication code.
OpenSSH 3.4 and later are not affected.
OpenSSH 3.2 and later prevent privilege escalation if
UsePrivilegeSeparation is enabled in sshd_config. OpenSSH
3.3 enables UsePrivilegeSeparation by default.
Although some earlier versions are not affected upgrading
to OpenSSH 3.4 is recommended, because OpenSSH 3.4 adds
checks for a class of potential bugs.
2. Impact:
This bug can be exploited remotely if
ChallengeResponseAuthentication
is enabled in sshd_config.
Affected are at least systems supporting s/key over
SSH protocol version 2 (OpenBSD, FreeBSD and NetBSD
as well as other systems supporting s/key with SSH).
Exploitablitly of systems using
PAMAuthenticationViaKbdInt
has not been verified.
3. Short-Term Solution:
Disable ChallengeResponseAuthentication in sshd_config.
and
Disable PAMAuthenticationViaKbdInt in sshd_config.
Alternatively you can prevent privilege escalation
if you enable UsePrivilegeSeparation in sshd_config.
4. Solution:
Upgrade to OpenSSH 3.4 or apply the following patches.
5. Credits:
ISS.
Appendix:
"
Anything is possible given time and money.
I'm hoping that someone else other than me has notice that this is not the first time that ISS has withheld security information. I applaud the guys at ISS for their efforts, but their delivery could use a little work.
Maybe this is troubling me more than it should, but when I start seeing the community divided against itself, I can't help but think that we will never succeed. I'm not saying there has to be perfect harmony and unity, but withholding security information goes against values that I believe everyone of us holds dear (full disclosure, open standards, systems and source, etc).
Nathan's blog
please post your ip i would love to see how this
ignore it and it will go away plan is working for
u.
Is it just me, or does telnet not have these problems? :-)
Someone set us up the bomb, so shine we are!
ftp.openssh.org is getting hammered right now... sigh.
my old sig used to be funny, but then slashcode ate it and now it's not funny anymore
Can someone please explain why this vulnerability was handled this way? Why wasn't there a maintainance release that just fixed the @#$@#% problem?
On the other hand, I charge by the hour when I upgrade my client's machines. So thanks Theo! $-)
Why don't YOU make a fix and give it away? How about a whole OS? Oh, I see, so shut up.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
Hmm... "There's a problem, we won't tell you what it is, but if you upgrade to the newest version, it will go away, plus you'll get nifty new features along with it!" Where have I heard that before?
The worst part is that many who upgraded (Anyone using Debian Potato for instance) actually BECAME vulnerable to at least a non-root exploit by upgrading where the old 1.2.3 version they were using didn't have the hole at all.
While I understand that full disclosure before a fix is available can be a bad thing, leading people to break their systems AND become vulnerable to the exploit when a simple configuration change could have protected the vast majority of users is far worse.
I would think that full disclosure to maintainers is a MUST.