Re: [Nolug] [Scott Harney <scotth@scottharney.com>] Re: [brlug-general] I hope everyone has either patched or secured their SSH servers.

Scott Harney <scotth@scottharney.com> writes:

> This is a big one guys.

Is it? From the OpenSSH advisory:

        All versions of OpenSSH's sshd prior to 3.7 contain a buffer
        management error. It is uncertain whether this error is
        potentially exploitable, however, we prefer to see bugs
        fixed proactively.

Doesn't sound too threatening. Right now rumors of an exploit are
just "Friend of a Friend" type information: "Just what I've heard by
proxy."
http://lists.netsys.com/pipermail/full-disclosure/2003-September/010116.html
http://lists.netsys.com/pipermail/full-disclosure/2003-September/010125.html

An alternative is to use lsh (http://www.lysator.liu.se/~nisse/lsh/)
which, if nothing else, gets you points on the obscurity front. Gets
you out of the openssh upgrade cycle for a bit, anyway.

But, really, saying this is "a big one" seems un-called-for right now.

Unless you have a pointer to an exploit being found, that is...

Mark.
___________________
Nolug mailing list
nolug@nolug.org
Received on 09/16/03