[linux-sec-uk] OpenSSH buffer management error

[Dan Rowles]

Whilst I'm pretty confident that you're right, how sure are you? Does
the vulnerable point in the code occur after the tcpwrappers check, or
before?

RedHat have a patch out now - but you have to go to updates.redhat.com
to actually get it - it's not hit mirror.ac.uk yet :( Nothing I can see
from debian yet, though.

Dan



On Tue, 2003-09-16 at 20:14, James Fidell wrote:
> Quoting James Davis (jamesd@jml.net):
> 
> > Am sure you've already heard of today's announcement of the flaw in
> > OpenSSH detailed at http://www.openssh.com/txt/buffer.adv but I felt this
> > affects enough people to justify a posting to this list. Exploits are in
> > the wild already so upgrade to OpenSSH 3.7 (see your vendor or
> > openssh.com) or apply the patch provided at OpenSSH.com
> 
> And if you have lots of servers to sort out and need a quick fix first,
> blocking untrusted connections with tcpwrappers may be a good option.
> 
> James
> 
> _______________________________________________
> linux-sec-uk mailing list
> linux-sec-uk@mailman.lug.org.uk
> http://mailman.lug.org.uk/mailman/listinfo/linux-sec-uk