OS and Software > All Things Unix > UNCONFIRMED: SSH 4.3 0day

UNCONFIRMED: SSH 4.3 0day

quote:

---

Just to be on the safe side this may not be legit, but then again it
may be.

In the links below openssh 4.3 it appears being exploited. Previously
there were some vulnerabilities in this version in the past but they
seemed to be crc d0s's.

Links talking about ssh 0day:
»secer.org/hacktools/0day-openssh···oit.html
»baoz.net/0day-openssh-remote-exploit/

Right now I would still classify this as a rumor until more
information on this comes out or the capabilities of the authors of
these sites has been mapped out.
I have received one report this morning about ssh vulnerabilities (and
0day) and have had an old old 0day rumor from GCon (2004ish) that was
rumored at the con, but never surfaced. (but was boasted about by some
very skilled individuals).

If you have ssh open remotely , please monitor your external systems.

---

I wanted to add I've seen anti-sec before:

»Owned Linux Boxes

reply to SirMeowmix_III

Rumours About OpenSSH in Red Hat Enterprise Linux

quote:

---

A posting on the Web Hosting Talk forum is feeding speculation about a critical security vulnerability in the OpenSSH server in CentOS/Red Hat Enterprise Linux (RHEL). According to the posting, the vulnerability is present in the OpenSSL version 4.3 used in this distribution. Although the version number is already several years old, the Red Hat development team tend to backport patches for older versions, with the result that the software may well still be up-to-date.

It is rumoured, however, that the development team have introduced an error during this backporting process which may now be able to be exploited to gain access to servers. Scattered online reports of successful attacks, such as the recent attacks on ssanz.net and, some weeks ago, on astalavista.com, may also point to the existence of a zero-day exploit for an unknown vulnerability in specific versions of SSH.

In response to an enquiry from heise Security (The H's associate in Germany), Red Hat's Security Response Team declined to confirm the existence of the vulnerability. They did state that they are aware of the rumours and are watching the situation with the aim of collecting more information. Should it prove to be the case that there is an unpatched vulnerability, they will react as quickly as possible.

The H Security and heise Security would be grateful for any further information on this problem from readers.

An error in the translation process lead to this story referring to OpenSSL. The H apologises for the error.

---

reply to SirMeowmix_III

Re: UNCONFIRMED: SSH 4.3 0day

You could not be more right.

reply to SirMeowmix_III
I'm going to hold my breath until tomorrow, at which point it won't be a zero-day any longer

reply to Bink

reply to Bink

Clearly it doesn’t contain all the fixes if the current version is not vulnerable. At this point you are putting your complete faith in the vendor—and it’s probably questionable whether this 3+ year old “fork” of OpenSSH should still be called OpenSSH.

reply to SirMeowmix_III
Makes sense, I should probably be shaking my fist at Ubuntu 8.04 LTS too, not just RHEL, right?

SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu1.2

Trust the distribution maintainers or compile from source.

reply to Bink

Ugh. Okay, here you go.

Windows/OSX: Wait for bug fix

Linux/BSD: Wait for bug fix or patch it yourself

It's really that simple, and it's why many people choose Linux and BSD. People encourage others to patch their own software because Linux and BSD afford you that opportunity.

As for the Windows security community, it's primarily a collection of proprietary software vendors whose products suffer the same problems as Windows. Find a vulnerability and you're at the mercy of the developer. That isn't to say that the community doesn't help, but the community is quite a bit different than the community surrounding Linux and BSD.

As for that Linux and BSD community, it is that community that finds and fixes many of the vulnerabilities you hear about. Rather than monetizing bug fixes with complicated defense software, developers fix the security problem at the source. Sure, this means that the fix typically gets published in generic form before your OS distributor has had a chance to fully test and integrate it within their systems, but it doesn't change the fact that you *do* have access to it.
--
Have more fun with your GPS.
Geocaching.com

Linux - Download from Tom, Dick or Harry and assume all is well.

Windows - Download from Microsoft and assume all is well.

Gee, which model makes more sense ... let me think.

You have inspired me to start my Linux install thread, who knows it may be entertaining.
--
"People demand freedom of speech as a compensation for the freedom of thought which they seldom use."

reply to pandora
Regressions and bugs are common with the GNU/Linux community, some that are introduced cause security concerns, others do not. This is something intrinsic with software development. Your comparison to the Win32 environment having a vibrant security community is laughable at best, especially from what I have seen first hand, as an IDS/Security guy.

No one is downloading dangerous content from trusted sites, the distribution maintainers need to be implicitly trusted to distribute good code just as Microsoft is implicitly trusted to not release defective-by-design or insecure-by-design software; funny to see them being ravaged by the recent IE ActiveX 0day.

I'm see no end-lusers being bad mouthed here, what I do see is a simple choice; trust the distribution maintainers to address security errata and have sufficient regression testing or compile from source.

While your book may be a best seller, and I wish you luck with that, I'm curious when the last time you build IIS, Internet Explorer, Media Player, or the other plethora of shovelware from source?

All the issues you've discussed are intrinsic with software development, luckily us GNU/Linux/UNIX users have an ace up our sleeves; compile from source.

reply to pandora

reply to pandora
I take security quite seriously—and this is why I said what I did. The Internet is a hostile place and threats are constantly evolving. If your vendor chooses to maintain their own branch/a legacy version of the most popular encrypted shell access tool there is, instead of incorporating the current stable version, well, then they reap what they sow—and they are the ones tarnishing the image of Linux, not I.

reply to SirMeowmix_III

Re: pandora