Re: Attacks against SSH?

[Florian Weimer <Florian.Weimer () RUS Uni-Stuttgart DE>]

"f.johan.beisser" <jan () caustic org> writes:

> the exploit is (supposedly) encrypted, stripped, and for x86 linux. the
> binary has an md5 checksum of 1309689a9af6b82e11e8dfa5c6282c30. it's
> ruffly 1.4 megs in size. i've only seen it as "x2".

We've seen a "targets" file accompanying the "x2" file.  It lists some
offsets, but only for SSH versions which are known to have the CRC32
bug.

-- 
Florian Weimer                    Florian.Weimer () RUS Uni-Stuttgart DE
University of Stuttgart           http://cert.uni-stuttgart.de/
RUS-CERT                          +49-711-685-5973/fax +49-711-685-5898

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com