OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq Archives: Re: ssh-1.2.27 remote buffer overflow - explo

Re: ssh-1.2.27 remote buffer overflow - exploitable (VD#7)


Szilveszter Adam (ccFLANKER.ITL.NET.UA)
Sun, 14 Nov 1999 22:31:54 +0100


On 13 Nov, Theo de Raadt wrote:
>> There appears to be a serious vulnerability in ssh 1.2.27. I will let the
>> folks who worked on this issue describe. There was brief discussion on
>> vuln-dev on the politics of ssh 1 vs. ssh 2, etc... you may or may not
>> want to play that out on Bugtraq. One of the key points of the SSH 1 vs.
>> SSH 2 debate is regarding licensing. Basically, because of a less strict
>> license on SSH 1, more folks are likely to be running that version. (This
>> is all referring to the Datafellows implementation that everyone uses,
>> rather than standards and protocols, I presume.)
>
> The upcoming OpenBSD 2.6 release contains/includes an ssh implimentation
> which is derived from an earlier ssh 1 (and thus has no Datafellows
> licencing issues). We are calling this ssh by the name "OpenSSH".
>
> Anyways, in the process of rewriting parts of ssh, the OpenSSH
> developers accidentally fixed this bug. Whoops! :-)
>
> So when the OpenBSD 2.6 release finally comes out (about 10 days from
> now?), I hope that this pre-announcement will stop us from being
> flooded with questions about this particular problem.....
>
Sorry, I could not miss this one, so:
<BRAGGING ON>
It is my pleasure tonight to announce that the same great OpenSSH
implementation is also available in the FreeBSD Ports Collection.
The other versions 1.2.27 (does not use RSAREF) and 2.0.13 also remain
available. Just an FYI to everybody using or considering to use this
great operating system!:-))
Thanks to all developers OpenBSD.org and the FreeBSD Porting Team!
<BRAGGING OFF>

Wish you all the very best with your work on OpenBSD! Keep up the good
work!

Cheers!

Szilveszter ADAM



This archive was generated by hypermail 2.0b3 on Sun Nov 14 1999 - 16:46:19 CST