oss-security - FreeBSD 4.x OpenSSH/libopie remote root hole

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110704230906.GA11990@openwall.com>
Date: Tue, 5 Jul 2011 03:09:06 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com, cperciva@...ebsd.org
Subject: FreeBSD 4.x OpenSSH/libopie remote root hole

Hi,

I'd be interested in more detail on this bug.  So far, the closest to a
description of the bug that I saw is this:

http://lists.openwall.net/full-disclosure/2011/07/01/4

but it's not enough.

I'd like to learn not only on my own, but also on others' mistakes. ;-)
And for this purpose it does not matter how old the software is and
whether it is still supported or not.

Colin - any comments from you?  I realize the bug is not yours, but
perhaps you're one of the few people who have figured it out now, for a
reason similar to mine.

Red Hat - a lesson for you might be to stop linking sshd against so
many libraries (over 20 last time I checked).  Don't wait until your
remote root, really. ;-)  Yes, this means dropping some functionality,
or maybe moving it to extra builds of sshd that only a small subset of
systems will choose to run (e.g., configurable via /etc/sysconfig/sshd).
Just an idea.

Thanks,

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.