Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSH: client bug CVE-2016-0777

undeadly.org

Post reply on HN
Print view View original

11–20 of 226 posts

Re: OpenSSH: client bug CVE-2016-0777

#11

Post by pmoriarty »

jlgaddis wrote: post #2

Workaround (yes, it's client-side): # echo -e "Host *\n\tUseRoaming no\n" >> /etc/ssh/ssh_config Disclaimer: won't work on all operating systems, shells, etc. YMMV. Consult a doctor before following any advice you get from the Internet. Void where prohibited. Restrictions may apply. Edited per comments below

Would this work too?

  $ echo "UseRoaming no" >> ~/.ssh/config

Re: OpenSSH: client bug CVE-2016-0777

#13

Post by Zr40 »

pmoriarty wrote: post #11
jlgaddis wrote: post #2

Workaround (yes, it's client-side): # echo -e "Host *\n\tUseRoaming no\n" >> /etc/ssh/ssh_config Disclaimer: won't work on all operating systems, shells, etc. YMMV. Consult a doctor before following any advice you get from the Internet. Void where prohibited. Restrictions may apply. Edited per comments below

Would this work too? $ echo "UseRoaming no" >> ~/.ssh/config

Yes, but it would not apply to other users.

Re: OpenSSH: client bug CVE-2016-0777

#14

Post by iamtew »

pmoriarty wrote: post #11
jlgaddis wrote: post #2

Workaround (yes, it's client-side): # echo -e "Host *\n\tUseRoaming no\n" >> /etc/ssh/ssh_config Disclaimer: won't work on all operating systems, shells, etc. YMMV. Consult a doctor before following any advice you get from the Internet. Void where prohibited. Restrictions may apply. Edited per comments below

Would this work too? $ echo "UseRoaming no" >> ~/.ssh/config

Yes, but it'll only affect that user.

Re: OpenSSH: client bug CVE-2016-0777

#15

Post by doogle88 »

jlgaddis wrote: post #2

Workaround (yes, it's client-side): # echo -e "Host *\n\tUseRoaming no\n" >> /etc/ssh/ssh_config Disclaimer: won't work on all operating systems, shells, etc. YMMV. Consult a doctor before following any advice you get from the Internet. Void where prohibited. Restrictions may apply. Edited per comments below

Presumably you would have to connect to a malicious host to be effected? Or perhaps a MITM on your connection to a legit host can exploit you somehow.

Re: OpenSSH: client bug CVE-2016-0777

#17

Post by merqurio »

DrRobinson wrote: post #10
merqurio wrote: post #5

As far as I know, this will affect any OSX, am I right ?

It affects all operating systems: http://marc.info/?l=openbsd-tech&m=145278077820529&w=2

Is there any way to update openssh on my side, without waiting to apple ? Is this enough ?https://mochtu.de/2015/01/07/updating-openssh-on-mac-os-x-10...

Re: OpenSSH: client bug CVE-2016-0777

#18

Post by ryanlol »

Someone tweeted this, the roaming code doesn't seem to be very well managed: https://twitter.com/marver/status/687644904575627264

Edit 1: Here's some relevant commits too https://marc.info/?l=openbsd-cvs&m=145278217421101&w=2

Edit 2: This mailing list post seems to discuss the vulnerable feature http://www.gossamer-threads.com/lists/openssh/dev/49018?do=p...

Edit 3: Got a better description of actual impact of the bugs:

>Experimental roaming code in the ssh client could be tricked by a hostile sshd

>server, potentially leaking key material. CVE-2016-077 and CVE-0216-078.

>Prevent this problem immediately by adding the line "UseRoaming no" to

>/etc/ssh/ssh_config.

Re: OpenSSH: client bug CVE-2016-0777

#19

Post by kardos »

praseodym wrote: post #12
moviuro wrote: post #3

The most terrible thing here is that OpenBSD usually does some full disclosure. This is sure going to be a nasty bug.

Why is this terrible? In any case, the software is open source so any security fix commit can also be considered as full disclosure.

But they didn't disclose the bug yet. The implication is that this bug is /so bad/ that it justified breaking the normal "just disclose it" approach.
Post reply on HN