OpenSSH: client bug CVE-2016-0777

#1

Post by moviuro » Thu, Jan 14, 2016, 2:36 PM UTC

OpenSSH: client bug CVE-2016-0777
undeadly.org

Re: OpenSSH: client bug CVE-2016-0777

#2

Post by jlgaddis » Thu, Jan 14, 2016, 2:39 PM UTC

Workaround (yes, it's client-side):

  # echo -e "Host *\n\tUseRoaming no\n" >> /etc/ssh/ssh_config

Disclaimer: won't work on all operating systems, shells, etc. YMMV. Consult a doctor before following any advice you get from the Internet. Void where prohibited. Restrictions may apply.

Edited per comments below

Re: OpenSSH: client bug CVE-2016-0777

#3

Post by moviuro » Thu, Jan 14, 2016, 2:42 PM UTC

The most terrible thing here is that OpenBSD usually does some full disclosure. This is sure going to be a nasty bug.

Re: OpenSSH: client bug CVE-2016-0777

#4

Post by Aissen » Thu, Jan 14, 2016, 2:44 PM UTC

Roaming feature has been in OpennSSH code for a while, but is undocumented: http://superuser.com/a/826734/47771

Re: OpenSSH: client bug CVE-2016-0777

#5

Post by merqurio » Thu, Jan 14, 2016, 2:46 PM UTC

As far as I know, this will affect any OSX, am I right ?

Re: OpenSSH: client bug CVE-2016-0777

#6

Post by moviuro » Thu, Jan 14, 2016, 2:48 PM UTC

merqurio wrote: post #5

As far as I know, this will affect any OSX, am I right ?

s/X//

Re: OpenSSH: client bug CVE-2016-0777

#7

Post by [deleted] » Thu, Jan 14, 2016, 2:48 PM UTC

merqurio wrote: post #5

As far as I know, this will affect any OSX, am I right ?

[deleted]

Re: OpenSSH: client bug CVE-2016-0777

#8

Post by ryanlol » Thu, Jan 14, 2016, 2:48 PM UTC

merqurio wrote: post #5

As far as I know, this will affect any OSX, am I right ?

According to Theo, yes.

Re: OpenSSH: client bug CVE-2016-0777

#9

Post by ryanlol » Thu, Jan 14, 2016, 2:48 PM UTC

[deleted] wrote: post #7

merqurio wrote: post #5

As far as I know, this will affect any OSX, am I right ?

[deleted]

This does not affect the sshd.

Re: OpenSSH: client bug CVE-2016-0777

#10

Post by DrRobinson » Thu, Jan 14, 2016, 2:48 PM UTC

merqurio wrote: post #5

As far as I know, this will affect any OSX, am I right ?

It affects all operating systems: http://marc.info/?l=openbsd-tech&m=145278077820529&w=2