[12578] in bugtraq
Re: ssh-1.2.27 remote buffer overflow - exploitable (VD#7)
daemon@ATHENA.MIT.EDU (Theo de Raadt)
Sun Nov 14 15:43:55 1999
Message-Id: <199911140318.UAA17977@cvs.openbsd.org>
Date: Sat, 13 Nov 1999 20:18:27 -0700
Reply-To: Theo de Raadt <deraadt@CVS.OPENBSD.ORG>
From: Theo de Raadt <deraadt@CVS.OPENBSD.ORG>
X-To: Blue Boar <BlueBoar@THIEVCO.COM>
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: Your message of "Sat, 13 Nov 1999 10:46:51 PST."
<382DB21B.CB92D7A0@thievco.com>
> There appears to be a serious vulnerability in ssh 1.2.27. I will let the
> folks who worked on this issue describe. There was brief discussion on
> vuln-dev on the politics of ssh 1 vs. ssh 2, etc... you may or may not
> want to play that out on Bugtraq. One of the key points of the SSH 1 vs.
> SSH 2 debate is regarding licensing. Basically, because of a less strict
> license on SSH 1, more folks are likely to be running that version. (This
> is all referring to the Datafellows implementation that everyone uses,
> rather than standards and protocols, I presume.)
The upcoming OpenBSD 2.6 release contains/includes an ssh implimentation
which is derived from an earlier ssh 1 (and thus has no Datafellows
licencing issues). We are calling this ssh by the name "OpenSSH".
Anyways, in the process of rewriting parts of ssh, the OpenSSH
developers accidentally fixed this bug. Whoops! :-)
So when the OpenBSD 2.6 release finally comes out (about 10 days from
now?), I hope that this pre-announcement will stop us from being
flooded with questions about this particular problem.....
