FYI
Cheers,
Domonkos Czinke
- Original Message -
From: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED]
To: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED]
Sent: Sunday, January 05, 2003 4:37 AM
Subject: OPENSSH REMOTE ROOT COMPROMISE ALL VERSIONS
-BEGIN PGP SIGNED MESSAGE
On Mon, 2003-01-06 at 18:44, Domonkos Czinke wrote:
FYI
Note:
Before the SSH server is actually executed, the sshd_config file should
be modified in order to enable PAM (PAMAuthenticationViaKbdInt yes).
and
you can prevent privilege escalation if you enable
UsePrivilegeSeparation in
Hi,
Johannes Verelst wrote:
Summarized, this exploit only works if you have in your sshd_config:
PAMAuthenticationViaKbdInt yes
UsePrivilegeSeparation no
The default values for both my unstable and stable debian boxes appear
to be:
PAMAuthenticationViaKbdInt
Subject: OPENSSH REMOTE ROOT COMPROMISE ALL VERSIONS
# gdb sshd 6552
This vulnerability seems to be useless if you have to be able to run gdb
locally AS ROOT (as demonstrated above)... If I have root access to a
machinewhy am I trying to exploit a vulnerability?
ponders
FYI
Cheers,
Domonkos Czinke
- Original Message -
From: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED]
To: bugtraq@securityfocus.com mailto:bugtraq@securityfocus.com
Sent: Sunday, January 05, 2003 4:37 AM
Subject: OPENSSH REMOTE ROOT COMPROMISE ALL VERSIONS
-BEGIN PGP SIGNED
On Mon, 2003-01-06 at 18:44, Domonkos Czinke wrote:
FYI
Note:
Before the SSH server is actually executed, the sshd_config file should
be modified in order to enable PAM (PAMAuthenticationViaKbdInt yes).
and
you can prevent privilege escalation if you enable
UsePrivilegeSeparation in
On Mon, 06 Jan 2003 at 06:44:17PM +0100, Domonkos Czinke wrote:
- Original Message -
From: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED]
To: bugtraq@securityfocus.com mailto:bugtraq@securityfocus.com
Sent: Sunday, January 05, 2003 4:37 AM
Subject: OPENSSH REMOTE ROOT COMPROMISE ALL
, 2003 4:37 AM
Subject: OPENSSH REMOTE ROOT COMPROMISE ALL VERSIONS
# gdb sshd 6552
This vulnerability seems to be useless if you have to be able to run gdb
locally AS ROOT (as demonstrated above)... If I have root access to a
machinewhy am I trying to exploit a vulnerability?
The gdb
05, 2003 4:37 AM
Subject: OPENSSH REMOTE ROOT COMPROMISE ALL VERSIONS
# gdb sshd 6552
This vulnerability seems to be useless if you have to be able to run gdb
locally AS ROOT (as demonstrated above)... If I have root access to a
machinewhy am I trying to exploit a vulnerability
9 matches
Mail list logo