[12586] in bugtraq
Re: ssh-1.2.27 remote buffer overflow - exploitable (VD#7)
daemon@ATHENA.MIT.EDU (Szilveszter Adam)
Sun Nov 14 17:36:09 1999
Mime-Version: 1.0
Content-Type: TEXT/plain; CHARSET=US-ASCII
Message-Id: <199911142131.WAA02694@sol.cc.u-szeged.hu>
Date: Sun, 14 Nov 1999 22:31:54 +0100
Reply-To: cc@flanker.itl.net.ua
From: Szilveszter Adam <cc@FLANKER.ITL.NET.UA>
X-To: BUGTRAQ@SECURITYFOCUS.COM
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <199911140318.UAA17977@cvs.openbsd.org>
On 13 Nov, Theo de Raadt wrote:
>> There appears to be a serious vulnerability in ssh 1.2.27. I will let the
>> folks who worked on this issue describe. There was brief discussion on
>> vuln-dev on the politics of ssh 1 vs. ssh 2, etc... you may or may not
>> want to play that out on Bugtraq. One of the key points of the SSH 1 vs.
>> SSH 2 debate is regarding licensing. Basically, because of a less strict
>> license on SSH 1, more folks are likely to be running that version. (This
>> is all referring to the Datafellows implementation that everyone uses,
>> rather than standards and protocols, I presume.)
>
> The upcoming OpenBSD 2.6 release contains/includes an ssh implimentation
> which is derived from an earlier ssh 1 (and thus has no Datafellows
> licencing issues). We are calling this ssh by the name "OpenSSH".
>
> Anyways, in the process of rewriting parts of ssh, the OpenSSH
> developers accidentally fixed this bug. Whoops! :-)
>
> So when the OpenBSD 2.6 release finally comes out (about 10 days from
> now?), I hope that this pre-announcement will stop us from being
> flooded with questions about this particular problem.....
>
Sorry, I could not miss this one, so:
<BRAGGING ON>
It is my pleasure tonight to announce that the same great OpenSSH
implementation is also available in the FreeBSD Ports Collection.
The other versions 1.2.27 (does not use RSAREF) and 2.0.13 also remain
available. Just an FYI to everybody using or considering to use this
great operating system!:-))
Thanks to all developers @OpenBSD.org and the FreeBSD Porting Team!
<BRAGGING OFF>
Wish you all the very best with your work on OpenBSD! Keep up the good
work!
Cheers!
Szilveszter ADAM
