OPENSSH REMOTE ROOT COMPROMISE ALL VERSIONS

2003-01-06 Thread Domonkos Czinke
FYI Cheers, Domonkos Czinke - Original Message - From: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] To: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] Sent: Sunday, January 05, 2003 4:37 AM Subject: OPENSSH REMOTE ROOT COMPROMISE ALL VERSIONS -BEGIN PGP SIGNED MESSAGE

Re: OPENSSH REMOTE ROOT COMPROMISE ALL VERSIONS

2003-01-06 Thread Johannes Verelst
On Mon, 2003-01-06 at 18:44, Domonkos Czinke wrote: FYI Note: Before the SSH server is actually executed, the sshd_config file should be modified in order to enable PAM (PAMAuthenticationViaKbdInt yes). and you can prevent privilege escalation if you enable UsePrivilegeSeparation in

Re: OPENSSH REMOTE ROOT COMPROMISE ALL VERSIONS

2003-01-06 Thread Ralf Dreibrodt
Hi, Johannes Verelst wrote: Summarized, this exploit only works if you have in your sshd_config: PAMAuthenticationViaKbdInt yes UsePrivilegeSeparation no The default values for both my unstable and stable debian boxes appear to be: PAMAuthenticationViaKbdInt

Re: OPENSSH REMOTE ROOT COMPROMISE ALL VERSIONS

2003-01-06 Thread Dossy
Subject: OPENSSH REMOTE ROOT COMPROMISE ALL VERSIONS # gdb sshd 6552 This vulnerability seems to be useless if you have to be able to run gdb locally AS ROOT (as demonstrated above)... If I have root access to a machinewhy am I trying to exploit a vulnerability? ponders

OPENSSH REMOTE ROOT COMPROMISE ALL VERSIONS

2003-01-06 Thread Domonkos Czinke
FYI Cheers, Domonkos Czinke - Original Message - From: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] To: bugtraq@securityfocus.com mailto:bugtraq@securityfocus.com Sent: Sunday, January 05, 2003 4:37 AM Subject: OPENSSH REMOTE ROOT COMPROMISE ALL VERSIONS -BEGIN PGP SIGNED

Re: OPENSSH REMOTE ROOT COMPROMISE ALL VERSIONS

2003-01-06 Thread Johannes Verelst
On Mon, 2003-01-06 at 18:44, Domonkos Czinke wrote: FYI Note: Before the SSH server is actually executed, the sshd_config file should be modified in order to enable PAM (PAMAuthenticationViaKbdInt yes). and you can prevent privilege escalation if you enable UsePrivilegeSeparation in

Re: OPENSSH REMOTE ROOT COMPROMISE ALL VERSIONS

2003-01-06 Thread Phillip Hofmeister
On Mon, 06 Jan 2003 at 06:44:17PM +0100, Domonkos Czinke wrote: - Original Message - From: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] To: bugtraq@securityfocus.com mailto:bugtraq@securityfocus.com Sent: Sunday, January 05, 2003 4:37 AM Subject: OPENSSH REMOTE ROOT COMPROMISE ALL

Re: OPENSSH REMOTE ROOT COMPROMISE ALL VERSIONS

2003-01-06 Thread Adrian 'Dagurashibanipal' von Bidder
, 2003 4:37 AM Subject: OPENSSH REMOTE ROOT COMPROMISE ALL VERSIONS # gdb sshd 6552 This vulnerability seems to be useless if you have to be able to run gdb locally AS ROOT (as demonstrated above)... If I have root access to a machinewhy am I trying to exploit a vulnerability? The gdb

Re: OPENSSH REMOTE ROOT COMPROMISE ALL VERSIONS

2003-01-06 Thread Dossy
05, 2003 4:37 AM Subject: OPENSSH REMOTE ROOT COMPROMISE ALL VERSIONS # gdb sshd 6552 This vulnerability seems to be useless if you have to be able to run gdb locally AS ROOT (as demonstrated above)... If I have root access to a machinewhy am I trying to exploit a vulnerability