Re: [openssh-unix-announce] Re: Upcoming OpenSSH vulnerability (fwd)

From: Peter C. Lai (sirmoo@cowbert.2y.net)
Date: 06/25/02 

Date: Mon, 24 Jun 2002 22:02:29 -0400
From: "Peter C. Lai" <sirmoo@cowbert.2y.net>
To: Chris BeHanna <behanna@zbzoom.net>

Is OpenSSH 3.3 now part of the base system? So are we phasing out
ssh as part of the base system (since the answer to the first
question is no, and therefore only the portable versions
have privsep available)? Again, we don't know if
older versions of ssh are vulnerable or not. I suppose
this notice is great for those on the bleeding edge, but
doesn't help the rest of the majority of users, who probably
*aren't* running 3.3. The freebsd security-officer tries
to help the general cross-section of the users, not just
the few who run the latest and greatest.

On Mon, Jun 24, 2002 at 09:35:06PM -0400, Chris BeHanna wrote:
> Although I sympathize with the desire to be able to make informed
> decisions regarding older versions of supported software that's in the
> field, I have to say that I side with Theo here: We're being warned that
> a critical exploit will be published in a few days, along with the
> simultaneous release of a version of the software that fixes the bug
> that leads to the exploit, AND we're being told how to immunize
> ourselves against the exploit--using currently-available
> software--several days in advance of the announcement.
>
> Result: it's possible to completely prevent the window of
> vulnerability that usually exists between the announcement of an
> exploit and the availability of a fix for same. Any other way
> *guarantees* that there will be a leak prior to the bugfix release,
> causing more than a few folks to get burned by the exploit before they
> get a chance to read their mail and learn how to enable the workaround.
> In a perfect world, Theo could publicize the exploit without fear of
> it being used to burn people prior to their learning how to use the
> workaround. But in a perfect world, we wouldn't need OpenSSH.
>
> Thank you, Theo.
>
> --
> Chris BeHanna
> Software Engineer (Remove "bogus" before responding.)
> behanna@bogus.zbzoom.net
> Turning coffee into software since 1990.
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message 

-- 
Peter C. Lai
University of Connecticut
Dept. of Molecular and Cell Biology | Undergraduate Research Assistant
http://cowbert.2y.net/
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages

  • Re: [openssh-unix-announce] Re: Upcoming OpenSSH vulnerability (fwd)
    ... We're in the process of merging OpenSSH 3.3 into -CURRENT, ... the nature of the vulnerability once vulnerability information is ... > Is OpenSSH 3.3 now part of the base system? ... I have to say that I side with Theo here: ...
    (FreeBSD-Security)
  • Re: two SSH compatibility scenarios: can it work?
    ... We are required to use SSH to log into the Engineering lab machines. ... > server software displays this header upon telnet connection to port 22. ... I still use Windows on my notebook for application compatibility. ... > running OpenSSH 3.4p1. ...
    (comp.security.ssh)
  • Re: OpenSSH, Telnet, Windows Authentication and double-hops
    ... deployment on a Windows network. ... Does this mean that you are setting SSH port forwarding ... does not provide the other side with either a Kerberos ticket, ... We're focusing on the OpenSSH for Windows distribution. ...
    (comp.security.ssh)
  • Re: Solaris 9 SSH: HostbasedAuthentication?
    ... > Subject: Solaris 9 SSH: HostbasedAuthentication? ... > authentication. ... I'm gathering that the OpenSSH version it's based on didn't have ...
    (Focus-SUN)
  • Re: SSH2 and ZSH
    ... implementation of SSH that is not present in the BSD standard OpenSSH. ... That said it would sound to me like you have a path problem not and SSH ... FreeBSD installs ping by default in /sbin and a ... > I recently installed FreeBSD 5.4 on a new server.everything is smooth and ...
    (freebsd-questions)