Full Disclosure mailing list archives
Re: new ssh exploit?
From: Ron DuFresne <dufresne () winternet com>
Date: Tue, 16 Sep 2003 10:23:37 -0500 (CDT)
also is ssh enabled with fallback to ssh1? ssh2 being far more secure and the supported standard. ssh1 has had a number of sploits pushed about over the past few years, and the only know sploit of ssh2 was it's ability to fallback to ssh1, at least that I'm aware of, and this might well have been resolved in the privsep code in newer ssh deamons as Adam was referencing. Thanks, Ron DuFresne On Mon, 15 Sep 2003, Adam Shostack wrote:
Is privsep on in any of these systems? Do the failed attempts show up in your logs? And naturally, do you have some tcpdumps? Adam On Mon, Sep 15, 2003 at 01:48:34PM -0400, christopher neitzert wrote: | More on this; | | The systems in question are FreeBSD, RedHat, Gentoo, and Debian all | running the latest versions of OpenSSH. | | The attack makes an enormous amount of ssh connections and attempts | various offsets until it finds one that works permitting root login. | | I have received numerous messages from folks requesting anonymity or | direct-off-list-reply confirming this exploit; | | The suggestions I have heard are: | | Turn off SSH and | | 1. upgrade to lsh. | | or | | 2. add explicit rules to your edge devices allowing ssh from only-known | hosts. | | or | | 3. put ssh behind a VPN on RFC-1918 space. | | thanks. | | | | | On Mon, 2003-09-15 at 12:02, christopher neitzert wrote: | > Does anyone know of or have source related to a new, and unpublished ssh | > exploit? An ISP I work with has filtered all SSH connections due to | > several root level incidents involving ssh. Any information is | > appreciated. | > | > | -- | Christopher Neitzert - GPG Key ID: 7DCC491B -- "It is seldom that liberty of any kind is lost all at once." -Hume _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "Cutting the space budget really restores my faith in humanity. It eliminates dreams, goals, and ideals and lets us get straight to the business of hate, debauchery, and self-annihilation." -- Johnny Hart ***testing, only testing, and damn good at it too!*** OK, so you're a Ph.D. Just don't touch anything. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: new ssh exploit?, (continued)
- Re: new ssh exploit? security snot (Sep 15)
- Re: new ssh exploit? phlox (Sep 15)
- Re: new ssh exploit? Andreas Gietl (Sep 16)
- Re: new ssh exploit? Florian Weimer (Sep 16)
- Re: new ssh exploit? Michael 'Moose' Dinn (Sep 16)
- RE: new ssh exploit? Aditya (Sep 17)
- Re: new ssh exploit? Cael Abal (Sep 17)
- Re: new ssh exploit? Andreas Gietl (Sep 16)
- Re: new ssh exploit? Adam Shostack (Sep 15)
- Re: new ssh exploit? Justin Kreger (Sep 15)
- Re: new ssh exploit? Ron DuFresne (Sep 16)
- Re: new ssh exploit? Jonathan A. Zdziarski (Sep 16)
- Re: new ssh exploit? Valdis . Kletnieks (Sep 17)
- Re: new ssh exploit? Valdis . Kletnieks (Sep 17)
- Re: new ssh exploit? Bennett Todd (Sep 16)
- Re: new ssh exploit? Ron DuFresne (Sep 16)
- Re: new ssh exploit? Bennett Todd (Sep 16)
- Re: new ssh exploit? Blue Boar (Sep 16)
- Re: new ssh exploit? Bennett Todd (Sep 17)
- Re: new ssh exploit? Bennett Todd (Sep 18)