OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Alex de Joode (usurazedz.net)
Date: Wed Jun 26 2002 - 09:20:48 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    On Wed, Jun 26, 2002 at 04:13:44PM +0200, Alex de Joode wrote:
    > http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=20584
    >
    > OpenSSH Remote Challenge Vulnerability
    >
    > Synopsis:
    >

    Description:

    A vulnerability exists within the "challenge-response" authentication
    mechanism in the OpenSSH daemon (sshd).
    [..]

    Recommendations:

    ISS X-Force recommends that system administrators disable unused OpenSSH
    authentication mechanisms. Administrators can remove this vulnerability
    by disabling the Challenge-Response authentication parameter within the
    OpenSSH daemon configuration file. This filename and path is typically:
    /etc/ssh/sshd_config. To disable this parameter, locate the
    corresponding line and change it to the line below:

    ChallengeResponseAuthentication no 

    --
So one config option seems could have saved the day ..

    Than why so much fuss, tech-push ?

    -- 
Alex de Joode
usurazedz.net