On Mon, Jun 24, 2002 at 03:14:39PM -0700, Mike Noyes wrote:
> There is a problem with OpenSSH.
>
> [Fwd: [SECURITY] [DSA-134-1] OpenSSH remote vulnerability]
> Theo de Raadt announced that the OpenBSD team is working with ISS
> on a remote exploit for OpenSSH (a free implementation of the
> Secure SHell protocol). They are refusing to provide any details on
> the vulnerability but instead are advising everyone to upgrade to
> the latest release, version 3.3.
Sounds like the bug isn't "fixed" but a work-around exists...
Here is how the Mandrake Security Release reads:
Mandrake Linux Security Update Advisory
________________________________________________________________________
Package name: openssh
Advisory ID: MDKSA-2002:040
Date: June 24th, 2002
Affected versions: 7.1, 7.2, 8.0, 8.1, 8.2, Corporate Server 1.0.1,
Single Network Firewall 7.2
________________________________________________________________________
Problem Description:
Details of an upcoming OpenSSH vulnerability will be published early
next week. According to the OpenSSH team, this remote vulnerability
cannot be exploited when sshd is running with privilege separation.
The priv separation code is significantly improved in version 3.3 of
OpenSSH which was released on June 21st. Unfortunately, there are some
known problems with this release; compression does not work on all
operating systems and the PAM support has not been completed.
The OpenSSH team encourages everyone to upgrade to version 3.3
immediately and enable privilege separation. This can be enabled by
placing in your /etc/ssh/sshd_config file the following:
UsePrivilegeSeparation yes
The vulnerability that will be disclosed next week is not fixed in
version 3.3 of OpenSSH, however with priv separation enabled, you will
not be vulnerable to it. This is because privilege separation uses a
seperate non-privileged process to handle most of the work, meaning
that any vulnerability in this part of OpenSSH will never lead to a
root compromise. Only access as the non-privileged user restricted in
chroot would be available.
MandrakeSoft encourages all of our users to upgrade to the updated
packages immediately. This update creates a new user and group on the
system named sshd that is used to run the non-privileged processes.
________________________________________________________________________
References:
http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=102495293705094&w=2
________________________________________________________________________
-------------------------------------------------------
This sf.net email is sponsored by: Jabber Inc.
Don't miss the IM event of the season | Special offer for OSDN members!
JabConf 2002, Aug. 20-22, Keystone, CO http://www.jabberconf.com/osdn
_______________________________________________
Leaf-devel mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/leaf-devel
