At 12:23 Uhr -0400 26.06.2002, Chris Devers wrote:
[This is really aimed at fink-devel, but I've cc'ed -users too as
I'm not sure if I'm properly subscribed to -devel at the moment...]
Ugh, not good, in that case only send to fink-users, but please don't
cross post unless it is absolutly necessary, and then, send the
messages seperatly to each list.
There's a remote security exploit in versions of OpenSSH prior to
this week's release of 3.4.
From: http://slashdot.org/article.pl?sid=02/06/26/1547242
Dan writes: "OpenSSH 3.4 has been released and will be
shortly available on all mirrors. All versions of
OpenSSH's sshd between 2.9.9 and 3.3 contain an input
validation error that can result in an integer overflow
and privilege escalation. OpenSSH 3.4 fixes this bug."
And kylus writes: "The previously-mentioned
vulnerability in OpenSSH has been disclosed by ISS
X-Force today on the BugTraq list. This is a potential
remote root compromise, and while there is a workaround,
it's advised that users upgrade to version 3.4 as soon
as they can."
http://online.securityfocus.com/archive/1/278818/2002-06-23/2002-06-29/0
Fink is currently providing a package for 3.2.2, which is one of
the vulnerable versions. Will an upgrade be coming out, Max?
Yes. However, please folks, don't spread panic.
ChallengeResponseAuthentication is off by default, and only when it
is on does any danger exist. Hence for the vast majority of SSH users
there is *NO* risk involved currently. Of course an updated package
will be put out shortly, but it's not all that bad as one might get
the impression.
Max
--
-----------------------------------------------
Max Horn
Software Developer
email: <mailto:max@xxxxxxxxx>
phone: (+49) 6151-494890
-------------------------------------------------------
This sf.net email is sponsored by: Jabber Inc.
Don't miss the IM event of the season | Special offer for OSDN members!
JabberConf 2002, Aug. 20-22, Keystone, CO http://www.jabberconf.com/osdn
_______________________________________________
Fink-users mailing list
Fink-users@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/fink-users
-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Caffeinated soap. No kidding.
http://thinkgeek.com/sf
|
