Re: [OT] Security hole in PuTTY (Windows ssh client)
it was said: > I think what you are saying is that if you use PuTTY as a client > application that you should be concerned about what server you > connect to? From what you are saying, I suspect that if the only > use is to connect to your own (FreeBSD) server, you are probably ok? > > Jay O'Brien Hello, To quote from the link: In SSH2, an attacker impersonating a trusted host can launch an attack before the client has the ability to determine the difference between the trusted and fake host. This attack is performed before host key verification. Presuming one were connecting over "private" network IP space by IP address only, then I believe you are correct. I can imagine scenarios in which if one were to connect over the Internet or even into a different network segment using DNS that one would be at risk. The vendor has a patched the hole and released 0.55, recommending all users update. If I were using this software, I would take their advice. Note: Apparently, a "Unix" version exists, and the source code is available under the MIT Licence. So I guess my post was "completely" OT. HTH, Stheg __ Do you Yahoo!? Y! Messenger - Communicate in real time. Download now. http://messenger.yahoo.com ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
Re: [OT] Security hole in PuTTY (Windows ssh client)
On Monday 16 August 2004 03:52 pm, stheg olloydson <[EMAIL PROTECTED]> wrote: > Hello, > > Sorry for the completely OT post, but I saw two mentions of PuTTY in > one day on the list and assume it must be a popular piece of Windows > software. It is written for *nix and win32, and it has an MIT license. > The SANS Institute "@Risk" newsletter dated 8AUG04 contains > the following item regarding PuTTY: > > 04.31.4 CVE: Not Available > Platform: Third Party Windows Apps > Title: PuTTY Remote Buffer Overflow > Description: PuTTY is a free Telnet and SSH client. It has been > reported that PuTTY is subject to a pre-authentication buffer > overflow that can allow malicious servers to execute code on a client > machine as it attempts to negotiate connection. PuTTY 0.54 and > previous versions are vulnerable. > Ref: > http://www.coresecurity.com/common/showdoc.php?idx=417&idxseccion=10 You forgot to include this (from the link above): *Solution/Vendor Information/Workaround:* PuTTY 0.55 fixes these vulnerabilities. It is available at: http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html PuTTY maintainers recommend that everybody upgrade to 0.55 as soon as possible. -- The latest PuTTY version in ports is 0.55. - jt ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
Re: [OT] Security hole in PuTTY (Windows ssh client)
stheg olloydson wrote: > Hello, > > Sorry for the completely OT post, but I saw two mentions of PuTTY in > one day on the list and assume it must be a popular piece of Windows > software. The SANS Institute "@Risk" newsletter dated 8AUG04 contains > the following item regarding PuTTY: > > 04.31.4 CVE: Not Available > Platform: Third Party Windows Apps > Title: PuTTY Remote Buffer Overflow > Description: PuTTY is a free Telnet and SSH client. It has been > reported that PuTTY is subject to a pre-authentication buffer overflow > that can allow malicious servers to execute code on a client machine > as it attempts to negotiate connection. PuTTY 0.54 and previous > versions are vulnerable. > Ref: > http://www.coresecurity.com/common/showdoc.php?idx=417&idxseccion=10 > > Again, sorry for the OT post, but it seems (at least) very marginally > relevant to some. We now return you regularly scheduled program of > FBSD > > Regards, > > Stheg > > I think what you are saying is that if you use PuTTY as a client application that you should be concerned about what server you connect to? From what you are saying, I suspect that if the only use is to connect to your own (FreeBSD) server, you are probably ok? Jay O'Brien ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
[OT] Security hole in PuTTY (Windows ssh client)
Hello, Sorry for the completely OT post, but I saw two mentions of PuTTY in one day on the list and assume it must be a popular piece of Windows software. The SANS Institute "@Risk" newsletter dated 8AUG04 contains the following item regarding PuTTY: 04.31.4 CVE: Not Available Platform: Third Party Windows Apps Title: PuTTY Remote Buffer Overflow Description: PuTTY is a free Telnet and SSH client. It has been reported that PuTTY is subject to a pre-authentication buffer overflow that can allow malicious servers to execute code on a client machine as it attempts to negotiate connection. PuTTY 0.54 and previous versions are vulnerable. Ref: http://www.coresecurity.com/common/showdoc.php?idx=417&idxseccion=10 Again, sorry for the OT post, but it seems (at least) very marginally relevant to some. We now return you regularly scheduled program of FBSD Regards, Stheg __ Do you Yahoo!? New and Improved Yahoo! Mail - 100MB free storage! http://promotions.yahoo.com/new_mail ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
