Re: [d-security] Re: DSA-134-1

2002-06-27 Thread Wichert Akkerman
Previously Christian Hammers wrote: Don't be too hard to him, if he'd pointed out that only default BSD is vulnerable it would not have been too hard to find the exploit before everybody had updated. He could have mentioned ssh protocol 1 wasn't vulnerable.. Wichert. --

Re: [d-security] Re: DSA-134-1

2002-06-27 Thread Tim Haynes
Wichert Akkerman [EMAIL PROTECTED] writes: Previously Christian Hammers wrote: Don't be too hard to him, if he'd pointed out that only default BSD is vulnerable it would not have been too hard to find the exploit before everybody had updated. He could have mentioned ssh protocol 1

Re: [d-security] Re: DSA-134-1

2002-06-27 Thread Phillip Hofmeister
On Thu, Jun 27, 2002 at 09:12:41AM +0100, Tim Haynes wrote: I'm trying not to think how many Debian policies have been bent because of oh no! it's ssh!-factor - porting a protocol-2-enabled *new feature* down to Stable with the resultant paragraphs on `create a proto-2 keypair' and `these are

Re: [d-security] Re: DSA-134-1

2002-06-26 Thread Christian Hammers
On Wed, Jun 26, 2002 at 07:23:49PM +0200, Florian Weimer wrote: Well, it appears if OpenSSH 1.2.3 was *not* vulnerable, so the whole exercise was rather pointless. But drill inspector Theo (update and don't ask questions, soldier!), showed at least how good our new security upload architecture