OpenSSH UseLogin Vulnerability
BID:1334
Info
OpenSSH UseLogin Vulnerability
| Bugtraq ID: | 1334 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 08 2000 12:00AM |
| Updated: | Jun 08 2000 12:00AM |
| Credit: | First posted to Bugtraq by Markus Friedl <[email protected]> on June 9, 2000. |
| Vulnerable: |
OpenBSD OpenSSH 2.1 OpenBSD OpenSSH 1.2.3 OpenBSD OpenSSH 1.2 |
| Not Vulnerable: |
OpenBSD OpenSSH 2.1.1 |
Exploit / POC
Solution / Fix
OpenSSH UseLogin Vulnerability
Solution:
OpenSSH 2.1.1 is fixed and is not vulnerable to this attack. It can be obtained at:
http://www.openssh.com/ftp.html
The following software distributions have released their respective patched packages at the locations below:
RedHat Linux:
ftp://ftp.redhat.de/pub/rh-addons/security/current
Connectiva Linux:
DIRECT DOWNLOAD LINKS TO UPDATED PACKAGES
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.0/i386/openssh-2.1.1p1-1cl.i386.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.0/i386/openssh-askpass-2.1.1p1-1cl.i386.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.0/i386/openssh-askpass-gnome-2.1.1p1-1cl.i386.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.0/i386/openssh-clients-2.1.1p1-1cl.i386.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.0/i386/openssh-server-2.1.1p1-1cl.i386.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.0/i386/openssl-0.9.5a-1cl.i386.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.0/i386/openssl-devel-0.9.5a-1cl.i386.rpm
DIRECT LINK TO THE SOURCE PACKAGE
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.0/SRPMS/openssh-2.1.1p1-1cl.src.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.0/SRPMS/openssl-0.9.5a-1cl.src.rpm
FreeBSD:
Versions of FreeBSD 4 and 5, released after June 11, 2000 contain a version of OpenSSH that is not vulnerable to this problem. For those users who do not want to download and install the latest version of OpenSSH, a patch has been made available.
Solution:
OpenSSH 2.1.1 is fixed and is not vulnerable to this attack. It can be obtained at:
http://www.openssh.com/ftp.html
The following software distributions have released their respective patched packages at the locations below:
RedHat Linux:
ftp://ftp.redhat.de/pub/rh-addons/security/current
Connectiva Linux:
DIRECT DOWNLOAD LINKS TO UPDATED PACKAGES
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.0/i386/openssh-2.1.1p1-1cl.i386.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.0/i386/openssh-askpass-2.1.1p1-1cl.i386.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.0/i386/openssh-askpass-gnome-2.1.1p1-1cl.i386.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.0/i386/openssh-clients-2.1.1p1-1cl.i386.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.0/i386/openssh-server-2.1.1p1-1cl.i386.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.0/i386/openssl-0.9.5a-1cl.i386.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.0/i386/openssl-devel-0.9.5a-1cl.i386.rpm
DIRECT LINK TO THE SOURCE PACKAGE
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.0/SRPMS/openssh-2.1.1p1-1cl.src.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.0/SRPMS/openssl-0.9.5a-1cl.src.rpm
FreeBSD:
Versions of FreeBSD 4 and 5, released after June 11, 2000 contain a version of OpenSSH that is not vulnerable to this problem. For those users who do not want to download and install the latest version of OpenSSH, a patch has been made available.