Not sure if folks have seen this. If not, better go read it.
http://www.openssh.com/txt/preauth.adv
http://www.openssh.com/txt/iss.adv
-Ian
Just be sure you read the full advisory and look deep into it
and your own configuration. Recent news has come to light which appears
that it is most *BSD OS flavors and those using BSD_AUTH and SKEY. Most
often these are not enabled by default on non-BSD OSes.
Jeremy
Jeremy T. Bouse(Jeremy.Bouse@UnderGrid.net)@2002.06.26 13:40:28 +0000:
Just be sure you read the full advisory and look deep into it
and your own configuration. Recent news has come to light which appears
that it is most *BSD OS flavors and those using BSD_AUTH and SKEY. Most
often these are not enabled by default on non-BSD OSes.
according to several discussions that took part in the last 48 hours,
the flaw fixed in 3.4 might also impact on systems using PAM for
authenticating ssh logins; it appears to me that the involved group of
researchers did not test operating systems other than the free *BSDs.
CA-2002-18 has some more vendor specific information:
http://www.cert.org/advisories/CA-2002-18.html
sure, it's a critical bug, but one should not oversee the apache chunk
handling vulnerability published in CA-2002-17 as it has been integrated
into skr1ptk1dd13's "tools" already, apparently. depending on your
site's policy you probably have tight restrictions on ssh access, but
http is probably allowed from 0/0 so it might be even more critical.
regards,
/k