Re: [Rumor] SSH (non)0-day

[Matt <weysec () gmail com>]

Not to incite the riot that always follows this type of comment, but
this attach does not match 0-day requirements. It is only for older
versions, meaning that if you patched your OpenSSH two or three months
ago when they released the patches for a security issue that was not
yet in the wild then you would not have an issue with this supposed
0-day. It is only a 0-day if you failed to follow patching procedures
or were not paying attention to the original patch several months ago.

Please oh trollers, troll away. But can we please move on to real
topics. You guys are making me miss NetDEV and his useless
conversations on this list.

Sent to you by Matt via Google Reader: Re: [Rumor] SSH 0-day via Full
Disclosure (fulldisclosure) Mailing List on 7/9/09
Posted by James Matthews on Jul 9

I am worried that if it is an OpenSSH 0day how much damage should I
expect.
However SANS doesn't seem to think it's real.

James

On Thu, Jul 9, 2009 at 12:46 PM, Kaspar Mendev <kaspar.m_at_gmx.com>
wrote:

> See also their update http://isc.sans.org/diary.html?storyid=6760

...





Things you can do from here:
- Subscribe to Full Disclosure (fulldisclosure) Mailing List using
Google Reader
- Get started using Google Reader to easily keep up with all your
favorite sites

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/