Slashdot Mirror
New Vulnerabilities in Portable OpenSSH
An anonymous reader writes "The OpenSSH team has uncovered multiple exploitable vulnerabilities in the days-old portable release of OpenSSH. That's right folks: time to patch *again*. 3.7.1p2 is now available. Instructions and mirror list here. Please note that this vulnerability only affects *portable* OpenSSH--so if you are running OpenBSD, you're safe. This vulnerability apparently has to do with PAM, so you can use the 'UsePam no' option in your config file. Info on the advisory here and here."
Note: This post is not intended as a troll or flamebait, I'm merely stating my opinion, which is this:
When this kind of thing can happen with such important and widely used open source software, I think people should take a moment to consider being more lenient towards Microsoft and their endless patches.
I'm not saying that MS products are in any way more secure than their OSS equivalents, indeed they are most likely less secure, but we need to remember that theirs are not the only insecure programs in the world. Take heed people.
You backspaced twice, but you only needed to replace the 5 with 0, thus only needing to erase one of the characters. Hence:
15^H0 minutes without a remote root exploit!
... oh, wait. You were doing that for illustratory purposes...
I reeealy need to get a life...
Microsoft could learn something from this. The OpenSSH team finds a problem,
announces it, and makes a fix available. Then they identify similar problems,
announce them, and make fixes available.
Microsoft seems to follow one of three different procedures depending on
circumstances:
1. ignore the problem until there's an exploit and public outcry
2. quietly release a fix and then advertise it when there's an exploit and
public outcry
3. leave the problem unfixed in order to force people to upgrade
I say we bash Microsoft until they start designing their products with
security in mind.
*sigh* back to work...