[linux-sec-uk] OpenSSH buffer management error

[Doug Winter]

--wzJLGUyc3ArbnUjN
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue 16 Sep James Davis wrote:
> Am sure you've already heard of today's announcement of the flaw in
> OpenSSH detailed at http://www.openssh.com/txt/buffer.adv but I felt this
> affects enough people to justify a posting to this list. Exploits are in
> the wild already so upgrade to OpenSSH 3.7 (see your vendor or
> openssh.com) or apply the patch provided at OpenSSH.com

Have you got a reference to your 'exploits in the wild'? =20

I was under the impression that this overflow was most likely
unexploitable (for anything other than DoS).

Cheers,

Doug.

--=20
6973E2CF print 2C95 66AD 1596 37D2 41FC  609F 76C0 A4EC 6973 E2CF
"If you are the type of person who likes assault weapons, there
is a place for you - the United States Army. We have them."
   -- General Wesley Clark, responding to a question on gun control


--wzJLGUyc3ArbnUjN
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE/aCYndsCk7Glz4s8RAs44AJ4nZRva/VV13mmdXvAfHn94h7B7NwCbBZKx
HGkKFBBa5AwkLVBtMDUvYNY=
=LjoC
-----END PGP SIGNATURE-----

--wzJLGUyc3ArbnUjN--