known_hosts vulnerability?

From: Gabriel M. Elder (eldergabriel_at_charter.net)
Date: 05/18/05

  • Next message: Damien Miller: "Re: known_hosts vulnerability?"
    To: secureshell@securityfocus.com, openssh-unix-dev@mindrot.org
    Date: Wed, 18 May 2005 14:30:38 -0500
    
    

    Hey all,

    I came across a security news article, referenced by
    http://www.linux.org/news, at

    http://www.techworld.com/security/news/index.cfm?NewsID=3668

    talking about an SSH weakness involving the known_hosts file. I
    apologize if this issue has already been addressed, but the mailing list
    archives didn't turn up anything when i tried searching for something
    relevant. So; not to knee-jerk or anything, but is anyone currently
    looking into this? Does this need to be addressed, or has it already
    been taken care of? Offhand, on a scale of 0 - 11, this would seem to
    rate kinda high, ~7. Am i off-base?

    >From the article: "a known_hosts hashing scheme proposed by MIT has been
    implemented in OpenSSH 4.0 and in a patch for earlier versions of SSH".
    Looking at my own ~/.ssh/known_hosts file, the entries appear to be
    encrypted, by default; i assume this is a Good Thing. Installed ssh
    package = openssh-server-3.9p1-8.0.1. Shall i now resume my warm fuzzies
    and assume all is snug and secure in openssh-land?


  • Next message: Damien Miller: "Re: known_hosts vulnerability?"

    Relevant Pages

    • Re: Recent OpenSSH releases not reading .bashrc for ssh commands
      ... their .bashrc will no longer get them without engaging in..... ... ssh can invoke bash without it then reading .bashrc. ... which svn", the .bashrc is no longer read. ... you're on RHEL 5, you've installed an updated OpenSSH, and you try to ...
      (comp.security.ssh)
    • Re: two SSH compatibility scenarios: can it work?
      ... We are required to use SSH to log into the Engineering lab machines. ... > server software displays this header upon telnet connection to port 22. ... I still use Windows on my notebook for application compatibility. ... > running OpenSSH 3.4p1. ...
      (comp.security.ssh)
    • Re: OpenSSH, Telnet, Windows Authentication and double-hops
      ... deployment on a Windows network. ... Does this mean that you are setting SSH port forwarding ... does not provide the other side with either a Kerberos ticket, ... We're focusing on the OpenSSH for Windows distribution. ...
      (comp.security.ssh)
    • Re: ssh compatability issues
      ... >> without keeping two versions of ssh around on my home computer. ... running the OpenSSH server that comes with Solaris ... By 'some old security problems with that' I was not sure if you meant ...
      (comp.security.ssh)
    • Re: Solaris 9 SSH: HostbasedAuthentication?
      ... > Subject: Solaris 9 SSH: HostbasedAuthentication? ... > authentication. ... I'm gathering that the OpenSSH version it's based on didn't have ...
      (Focus-SUN)