Slashdot Mirror
OpenSSH Vulnerability Discovered
farker haiku writes "Those of you who haven't heard of the metasploit project, it's an open source product for performing security audits. This time they've managed to find a remote buffer overflow in OpenSSH. Ya'll might want to read the link and then do whatever updating is necessary." It's unfortunate that something like this gets released today since nobody will bother to patch.
My stomach had a couple of buffer overflows last-night. It was sploited by Arthur Guinness, well known for his ingenious bowel movement exploits.
It may take a life time to fix this vulnerability :(
Simon
C'mon, I dare you to send 1025 beers my way!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I don't know...if my buffer was overflowed with 1025 beers, I might not care about the pink....
then again I might not care about much at all at that point
Cheers!
I guess that this will only allow the sending of one kilobeer.
sudo mod me up
This exploit has been found to be connected to a flaw in the Beer.h library. Work to resolve this issue will be resumed shortly after those responsible are sober again.
Random complaining about April Fools. Mentioning that somehow my pathetic Slashbot life is above April Fools. Pretending that this somehow really inconviences me. Random ranting about the quality of Slashdot having degenerated. Not noting that I still seem to be here despite the supposed quality drop. More ranting, possibly about the current article. Protesting the personal problems this story has caused me. Indicating through my lack of a sense of humor that I must be from Finland. More random complaints, followed by a lack of the irony that I am so pathetic to take this joke personally.
----
-Signiture as unamusing as the current slashdot story.
Theo deRaadt kicked out of the OpenBSD project. Finally.
i fell for that one...almost had metasploit fired up :-/
btw check out Google's share of April fool's day : http://www.google.com/romance/index.html
Sent from my desktop computer
This one actually fooled me. Fifteen LOL's and one in normal English - brilliant.
Using the recently discovered openssh hole, hackers^Wvandales defaced the slashdot.jp page, and changed the new pink color scheme back to the old ugly green theme. Management of slashdot was not available for comment.
--
me spell? me not even now eigo.
Look, it's not funny anymore. No more April Fools jokes! OK!
The really unfunny thing is that this is _so_ obviously an April
Fools joke, that's it's not even remotely funny. At least the "UK
Government shutting down GSM" was a plausible story, but this...
Sheesh!
return 0; }
LINUX DEVELOPERS!! Look what you've done with your software now!!! You've put out the Sun!!!!
That poor guy probably worked for 6 hours getting the stick-figure ASCII art just right.
Paulo's News: Bringing You the Best of the Mainsternative Media
A remote exploit in openSSH is not something to be joking about...
*puts his nerdy glasses back on*
"Airplane falls, 335 killed"
HaHaHahaha... *snort*
According to IEC it's a kibibeer!
OMG lol you almost got me there for a second, i was rushing to patch my box but then i fi-#$!#@$%#@^&%
NO CARRIER
You know what really sucks? All these lame jokes are going to stick around on the internet forever and bite people on other days through the wonders of search engines and automatic caches.
What if there was somthing like this that was real? Would it get drowned out by all the 2006-4-1 posts?
Hello? Is this the open source community i have heard about? I met this guy at the pub yesterday and he was talking about this lunix thingy, i think it has something to do with computers. Either way, that doesn't matter. He told me something about being able to get free beer? Who do I contact to get the free beer?
$ sudo apt-get dist-upgrade
Reading package lists... Done
Building dependency tree... Done
Calculating upgrade... Done
The following NEW packages will be installed:
gcc-4.1-base
The following packages will be upgraded:
debhelper dmidecode e2fslibs e2fsprogs intltool-debian libblkid1 libcomerr2 libexpat1 libfreetype6 libgcc1 libnet-dns-perl libnewt0.52
libpng12-0 libpng3 libss2 libstdc++6 libtiff-tools libtiff4 libuuid1 mpd ncmpc openssh-client openssh-server pciutils python2.4
python2.4-minimal samba samba-common smbfs ssh valgrind whiptail
32 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 25.3MB of archives.
After unpacking 1109kB of additional disk space will be used.
Do you want to continue [Y/n]? y
[...]
Get:13 http://ftp.debian.org unstable/main openssh-server 1:4.2p1-8 [215kB]
Get:14 http://ftp.debian.org unstable/main openssh-client 1:4.2p1-8 [557kB]
Obligatory claim to be sick of this type of rant. Nitpicking of missing characteristics tied cleverly into a logical ambush that others visit anyway. Faux disgust at perceived "racist" joke". Redundant yet Insightful reminder that you aren't forced to come here. Lone two-word expletive and/or insult and/or personality criticism whose position and abruptness will surely send parent into depression.
Have they been alerted of this vulnerability, or has it happened already?
Mod up!!!!
As a side note, here's a recipe for Open Source Beer from Denmark - http://www.voresoel.dk/
This one had me fooled for a bit there. This is not something I like to joke about since it would have such drastic repercussions. I'm glad it's just a joke.. Or is it??
On behalf of the huge number of us who chuckled after the first couple of stories and now want to vomit and find another temporary news site for today...Please, for the love of god, make an option on the front page so you can turn off the April Fools stories and actually get real news. You are a news site, and while it is great to take part in this holiday and have some laughs, there's still plenty of actual news occuring and it pisses a great many of us off that we now have to go to alternate sources to hunt for it. And while Digg has its fair share of 4/1 stories, it also still has real stories, so I will be directing my traffic there for the rest of the day.
I'd be really curious to see some Slashdot traffic numbers comparing March 31st, April 1st and April 2nd. Bet you would see a HUGE dip today right around the time people started to get real tired of the dumb lame posts. What amuses me is that the creative tags people have started giving these lame stories are often more amusing than the stories themselves.
Buy Steampunk Clothing Online!
Thinking about how common it is for an average slashdotter to RTFA, this could actually lead to people blindly jumping into their car and speeding away to "patch those boxxors". Nice one!
I must admit from reading the title my heart missed a beat. Theres's gotta be something real on 1.april, no ?
Doolittle :
Bomb no.20 : To explode of course.
http://slashdot.jp/security/article.pl?sid=06/03/3 1/0518253
Guess what two of the posts say. April fool. No. I don't read Japanese. The only words in English on that website is April fool.
Ooo man the floppy drive is broken. No wait. The computer is just upside down.
No reason to worry - just use iptables:
iptables -I INPUT 1 -mlength --length 0:1024 --protocol beer -j DONTPAY
Theo de Raadt announces he intends to become a monk.
Past 12 o'clock you are the fool whoever tried this as a joke lololol
No joke from Google this year?
Very insightful comment by AC that no one will read.
Lets call openheineken and threaten them with the FBI if they don't send in massive crates of bear!
APRIL FOOLS!
sic
Whoops! Please allow me to correct the apostrophe misplacement:
3. Theo enjoys the monk's very good beer
-- "At Microsoft, quality is job 1.1" -- PC Magazine, Nov. 1994
At least this one got me to click on the link. "Well, if a new exploit was just discovered, they'd tell us, even though it's April Fool's..." I still want to stab Taco with a fork for that stupid AOL-speak shit, though.
Laws do not persuade just because they threaten. --Seneca
if that's a real SSH hole, they should no better than to release warnings on April 1st.
gigantino.tv - Heavy but weighs nothing.
Stop typing it out as "ya'll". I've got no problem with people transcribing dialect to words, for the love of ponies, when you're going to do it, do it right. When someone says it, they are saying "you all" ... this is what's known as a contraction and hence, should be spelled: "y'all".
Request to moderators to lift score of parent.
Read more of this story at Slashdot.Read more of this story at Slashdot.Read more of this story at Slashdot.
beer can be very effectively used to exploit openssh by applying it liberally to the key owner and getting them to share it with you...
a typical social engineering application, iinm
i've been killing my sshd upon boot for days now, waiting for a slackware security update that never came. i never actually clicked the link or read the comments for this article until now. fuck you slashdot