From owner-freebsd-security Sun Nov 14 13:56:53 1999 Delivered-To: freebsd-security@freebsd.org Received: from erouter0.it-datacntr.louisville.edu (erouter0.it-datacntr.louisville.edu [136.165.1.36]) by hub.freebsd.org (Postfix) with ESMTP id BD2E314DA1 for ; Sun, 14 Nov 1999 13:56:50 -0800 (PST) (envelope-from k.stevenson@louisville.edu) Received: from osaka.louisville.edu (osaka.louisville.edu [136.165.1.114]) by erouter0.it-datacntr.louisville.edu (Postfix) with ESMTP id C1D6924D0A; Sun, 14 Nov 1999 16:56:49 -0500 (EST) Received: by osaka.louisville.edu (Postfix, from userid 15) id 4550F18605; Sun, 14 Nov 1999 16:56:49 -0500 (EST) Date: Sun, 14 Nov 1999 16:56:49 -0500 From: Keith Stevenson To: Mike Tancsa Cc: freebsd-security@freebsd.org Subject: Re: Fwd: ssh-1.2.27 remote buffer overflow - exploitable (VD#7) Message-ID: <19991114165649.A95613@osaka.louisville.edu> References: <4.1.19991114000355.04d7f230@granite.sentex.ca> <4.1.19991114153939.046249a0@granite.sentex.ca> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0pre3i In-Reply-To: <4.1.19991114153939.046249a0@granite.sentex.ca> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Sun, Nov 14, 1999 at 03:46:00PM -0500, Mike Tancsa wrote: > > I am not so worried at this point about kerb integration, as I dont use it. > What I am worried about is remote root exploitation.... Or am I missing > something in the bugtraq post ? The poster indicates remote root > exploitation is difficult, but possible in > http://www.freebsd.org/cgi/query-pr.cgi?pr=14749 > I have cc'd the official maintainer. Perhaps he could comment ? I get the impression from the Bugtraq post that only SSH linked against RSAREF is vulnerable. Pity that those of us in the US are required to use the buggy code. Regards, --Keith Stevenson-- -- Keith Stevenson System Programmer - Data Center Services - University of Louisville k.stevenson@louisville.edu PGP key fingerprint = 4B 29 A8 95 A8 82 EA A2 29 CE 68 DE FC EE B6 A0 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message