Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
From: Markus Friedl (Markus.FriedlINFORMATIK.UNI-ERLANGEN.DE)
Date: Sun Feb 11 2001 - 06:15:09 CST
Tatu Ylonen wrote:
> > > It's real enough for most vendors to respond. I think you want
> > > to make sure your servers have at least 1.2.30/2.4.0 or
> > > openssh 2.3.0p1 at this point.
> > well, 1.2.30 does not contain a fix for this problem.
> No, but the current version is ssh-2.4.0, which does not suffer from this
> problem at all.
Well, you have to be very careful.
This is only true if ssh-2.4.0 has fallback to ssh1 disabled
and since the posting says "1.2.30/2.4.0" it implies that ssh1 support
So I'd like to point out again that:
1) ssh-2.4.0 is vulnerable iff fallback to ssh1 is enabled
(unless if falls back to openssh-2.3.0p1, but I assume that
this is very unlikely).
2) openssh-2.3.0p1 is _not_ vulnerable at all.
Note that it's not unlikely that ssh-2.x installations have ssh1 fallback
_enabled_ (> 50% in the network I did check).