http://lwn.net/Articles/3531/ (el texto est� al final de este mensaje)
Es imposible enfatizar la importancia de actualizar todos los servidores
de SSH que est�n corriendo en sus instituciones. Alguna gente parece no
haber entendedido el problema a�n: el punto no es que existe una falla
de seguridad en OpenSSH. El punto es que SSH es algo que se considera
seguro y por lo tanto es com�n que se dejen pasar conexiones de SSH por
los firewalls a fin de proveer un punto de entrada a las intranet.
En el link citado hay tambi�n un parche para los que no quieran
(comprensiblemente) actualizar sus paquetes de OpenSSH a la versi�n 3.4.
From: Markus Friedl <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: OpenSSH Security Advisory (adv.iss)
Date: Wed, 26 Jun 2002 16:42:13 +0200
1. Versions affected:
All versions of OpenSSH's sshd between 2.9.9 and 3.3
contain an input validation error that can result in
an integer overflow and privilege escalation.
OpenSSH 3.4 and later are not affected.
OpenSSH 3.2 and later prevent privilege escalation
if UsePrivilegeSeparation is enabled in sshd_config.
OpenSSH 3.3 enables UsePrivilegeSeparation by
default.
Although OpenSSH 2.9 and earlier are not affected
upgrading to OpenSSH 3.4 is recommended, because
OpenSSH 3.4 adds checks for a class of potential bugs.
2. Impact:
This bug can be exploited remotely if
ChallengeResponseAuthentication is enabled in sshd_config.
Affected are at least systems supporting
s/key over SSH protocol version 2 (OpenBSD, FreeBSD
and NetBSD as well as other systems supporting
s/key with SSH). Exploitablitly of systems
using PAM in combination has not been verified.
3. Short-Term Solution:
Disable ChallengeResponseAuthentication in sshd_config.
or
Enable UsePrivilegeSeparation in sshd_config.
4. Solution:
Upgrade to OpenSSH 3.4 or apply the following patches.
5. Credits:
ISS.
--
Desuscripci�n: escriba a [EMAIL PROTECTED], tema 'unsubscribe'
Problemas a: [EMAIL PROTECTED] http://www.linux.or.cr/listas
