Re: SSH2 Exploit?

[alex () WINSTAR NET (Alexander Kiwerski)]

Was statd, rpcd or syslogd running? All 3 have exploitable holes (depending
on version). Maybe not the culprit, but a place to look anyhow.

To my knowledge, 1.2.27 is the most solid version of SSH our there, but
there could be something around that I'm not aware of.....

-Alexander Kiwerski

At 06:30 PM 2/9/00 , Jonathan A. Zdziarski wrote:
> We recently had one of our remote logging servers compromised.  It was
> totally locked down running only ssh2; all inet processes were turned off.
> Unfortunately, they obliterated the disk so we were not able to get any
> information about how they exploited our machine, however since the only
> point of entry was SSH2, I'm very concerned about a possibly vulnerability
> in the code.  What is the general consensus of the 'most secure' version of
> ssh? 1.2.27?
>
> Thank you,
>
> Jonathan A. Zdziarski
> Director - MIS
> NetRail, inc.
> 230 Peachtree St.
> Suite 1700
> Atlanta, GA 30303
> 404-522-5400 x240