OpenBSD Journal

New SSH vulnerabilities, OpenSSH not affected

Contributed by jose on from the unbreakable? dept.

Chad Loder writes:
" Rapid7 has discovered a new class of vulnerabilities affecting SSH2 implementations from many vendors. These vulnerabilities affect a wide variety of SSH servers and SSH clients, including F-Secure, SSH Inc., PuTTY, etc. OpenSSH is not affected.

To test the security and robustness of a wide variety of SSH implementations, designed an SSH protocol test suite called SSHredder . The SSHredder test suite contains a large number of SSH2 protocol test cases and has been released under a BSD license. These test cases were systematically crafted to expose a wide range of vulnerabilities in SSH implementations. Rapid7's testing has revealed many defects ranging from simple buffer overflows to subtle string-handling errors."

Good to see that the careful design of OpenSSH can withstand the brutality of the shredder. CERT has released CA-2002-36 on the issue.

(Comments are closed)

Comments

  1. By El Volio () kylem@xwell.org on http://xwell.org

    It looks serious, sure ‐ except for the fact that nobody seems vulnerable. Looking at the CERT advisory, almost nobody is. PuTTY seems to have had some issues, and maybe Cray, but everyone else either says that they're not vulnerable or that the impact is nil. So I don't understand why CERT even bothered to release an advisory.

    Comments

    1. By David Krause () on http://www.rapid7.com/advisories/R7-0009.txt

      The CERT advisory doesn't do a very good job of listing everyone. Here's the vulnerable list from the rapid7 advisory:

      o F-Secure Corp. SSH servers and clients for UNIX
      v3.1.0 (build 11) and earlier
      o F-Secure Corp. SSH for Windows
      v5.2 and earlier
      o SSH Communications Security, Inc. SSH for Windows
      v3.2.2 and earlier
      o SSH Communications Security, Inc. SSH for UNIX
      v3.2.2 and earlier
      o FiSSH SSH client for Windows
      v1.0A and earlier
      o InterSoft Int'l, Inc. SecureNetTerm client for Windows
      v5.4.1 and earlier
      o NetComposite ShellGuard SSH client for Windows
      v3.4.6 and earlier
      o Pragma Systems, Inc. SecureShell SSH server for Windows
      v2 and earlier
      o PuTTY SSH client for Windows
      v0.53 and earlier (v0.53b not affected)
      o WinSCP SCP client for Windows
      v2.0.0 and earlier

  2. By RC () on

    I've said it before... I have it on good authority that there are exploits for SSH.com's latest version (3.2.0) floating around. Next time I talk with him, I'll see if this was one of them.

    So, OpenSSH was more secure than SSH even before priv sep was introduced, and I imagine OpenSSH's lead is only getting better.

    Comments

    1. By Anonymous Coward () on

      Wow, a troll saying he has something on good authority? How can we *not* believe you!

      Comments

      1. By smellyfart () on

        Because he isn't the only person who thinks this.

        I have heard rumors as well.

        Although I am not good authority, and in fact have no clue about anything. Just some dood on IRC told me that they have exploits and stuffs like that.

        so yah, werd up

        Comments

        1. By W () on

          Someone on IRC? Well, we just HAVE TO believe you then. IRC is serious business EXTRAVAGANZA!

          Comments

          1. By W () on

            And since you also say "dood" and "werd up," I cannot but take you seriously. No, really.

            Comments

            1. By Anonymous Coward () on

              word.

              Comments

              1. By W () on

                Uh.

      2. By RC () on

        > Wow, a troll saying he has something on good
        > authority? How can we *not* believe you!

        Well, I am not a troll, and you can search through previous posts of mine to see that I do not have a habbit of trolling nor of spreading false information.

        However, I do NOT have first-hand knowledge that the exploit(s) do(es) exist, so, yes, you should take this with a grain of salt.

      3. By couderc () on

        You call him a troll but you just post like an anonymous coward.
        At least, even if it was lying he takes on.

  3. By Anonymous Coward () on

    The announcement is PGP signed with:
    Version: GnuPG v1.0.7 (OpenBSD)

    Comments

    1. By W () on

      Huh, what?!

  4. By Anonymous Coward () on

    Am I the only one who read this post and immediately thought of shredder in ninja turtles? now THAT was a villian

    Comments

    1. By Anonymous Coward () on

      die

Latest Articles

Credits

Copyright © - Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]