|
|
There's a new vulnerabiltiy in the OpenSSH daemon. The OpenSSH/OpenBSD
team does not release any details concerning this issue, except:
|
|
-----BEGIN PGP SIGNED MESSAGE-----
There's a new vulnerabiltiy in the OpenSSH daemon. The OpenSSH/OpenBSD
team does not release any details concerning this issue, except:
- This bug still exists in the most recent version, 3.3
- They are asking all users to upgrade to version 3.3 (sic),
and enable the PrivilegeSeparation option.
Setting PrivilegeSeparation to on causes large portions of the daemon
to run in a so-called "chroot jail", i.e. in a very restricted environment.
An attacker breaking this part of the SSH daemon will *not* obtain full
root privilege (as he would if sshd runs without this option), but
will find himself in an empty directory, inside a process running as
a non privileged user (he can still do some harm this way, but it's
a far cry from full root powers, of course).
In a posting to bugtraq, Theo de Raadt says that using privilege
separation, this new vulnerability cannot be exploited.
The SuSE security team is working on creating OpenSSH updates with
privilege separation enabled, and testing this functionality. We
will release updated RPMs on FTP as they become available.
In the meanwhile, we suggest that
- if you do not need external access to your SSH daemons,
turn off the SSH service on these machine completely,
or block external access at the firewall.
- if you do need extern access to your SSH daemons,
make sure you restrict the hosts that it will talk to
by setting appropriate firewall rules.
If, for some reason, you cannot configure your firewall to
block external SSH access, you can also restrict access through
/etc/hosts.allow; the following will allow connections from
hosts with IP addresses 1.2.3.4 and 5.6.7.8 while disallowing
any other connections.
sshd : 1.2.3.4 : allow
sshd : 5.6.7.8 : allow
sshd : ALL : deny
It is not clear however whether this is really effective
because we do not know anything about the vulnerability
at all.
Olaf Kirch
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3in
Charset: noconv
iQEVAwUBPRgpi3ey5gA9JdPZAQFOfgf9Gzfs7N++Q8DkbAiEc2cbvUwKZjuS7yr/
GEaR3yRtBs/dyDVUB+EgEWgwwSDTwm4t6n0YfoyrnFdn5BZy+hDkFphJHabU7Vg8
39eN26AvvIgE0BxEg+Fq5kNYAApB+hvw/PLtQFFqSB3HHNfx227v03gzrC5xPuXN
DFE9BMf4rTHj+YykkoLFt9rS6tPE3l0hm7ZUz0MfGNxIqcjw6TP8L7LF1LxepSlN
QG0y//WoQafdbj9xY9ShbhdjloRMXg9XMMObcArNijASig4yw0sQ09clGPKtaYSA
qX53NV29hrcfAYyH5Ejgfa4X/8UEG/onCnR7qUdZP26x0oZLRiRPpw==
=IuTG
-----END PGP SIGNATURE-----
--
To unsubscribe, e-mail: suse-security-announce-unsubscribe@suse.com
For additional commands, e-mail: suse-security-announce-help@suse.com |
