OpenSSH Race condition resulting in potential remote code execution
1–10 of 29 posts
Re: OpenSSH Race condition resulting in potential remote code execution
#2[deleted]
Re: OpenSSH Race condition resulting in potential remote code execution
#3Sorry, duplicate of https://news.ycombinator.com/item?id=40843778
Re: OpenSSH Race condition resulting in potential remote code execution
#4>A critical vulnerability in sshd(8) was present in Portable OpenSSH
versions between 8.5p1 and 9.7p1 (inclusive) that may allow arbitrary
code execution with root privileges.
FYI that's every version published after 2021-03-03
That's got to be 99% of all linux machines in the world with an ssh daemon running right?
Re: OpenSSH Race condition resulting in potential remote code execution
#5Sorry, duplicate of https://news.ycombinator.com/item?id=40843778
I do like the headline of this post better though...
Re: OpenSSH Race condition resulting in potential remote code execution
#6>A critical vulnerability in sshd(8) was present in Portable OpenSSH versions between 8.5p1 and 9.7p1 (inclusive) that may allow arbitrary code execution with root privileges. FYI that's every version published after 2021-03-03 That's got to be 99% of all linux machines in the world with an ssh daemon running right? https://www.openssh.com/releasenotes.html
99%… that’s funny :P
Re: OpenSSH Race condition resulting in potential remote code execution
#7>A critical vulnerability in sshd(8) was present in Portable OpenSSH versions between 8.5p1 and 9.7p1 (inclusive) that may allow arbitrary code execution with root privileges. FYI that's every version published after 2021-03-03 That's got to be 99% of all linux machines in the world with an ssh daemon running right? https://www.openssh.com/releasenotes.html
Using this exploit, connected non root users can gain root access. Multiple user machines are more or less a thing of the past. These days most common use case of ssh is logging in to a remote server you already own with root privileges. So most of the users are unaffected by this exploit.
Re: OpenSSH Race condition resulting in potential remote code execution
#8>A critical vulnerability in sshd(8) was present in Portable OpenSSH versions between 8.5p1 and 9.7p1 (inclusive) that may allow arbitrary code execution with root privileges. FYI that's every version published after 2021-03-03 That's got to be 99% of all linux machines in the world with an ssh daemon running right? https://www.openssh.com/releasenotes.html
Using this exploit, connected non root users can gain root access. Multiple user machines are more or less a thing of the past. These days most common use case of ssh is logging in to a remote server you already own with root privileges. So most of the users are unaffected by this exploit.
I don't think it's best practice to give root privilege to a login account.
Re: OpenSSH Race condition resulting in potential remote code execution
#9>A critical vulnerability in sshd(8) was present in Portable OpenSSH versions between 8.5p1 and 9.7p1 (inclusive) that may allow arbitrary code execution with root privileges. FYI that's every version published after 2021-03-03 That's got to be 99% of all linux machines in the world with an ssh daemon running right? https://www.openssh.com/releasenotes.html
Using this exploit, connected non root users can gain root access. Multiple user machines are more or less a thing of the past. These days most common use case of ssh is logging in to a remote server you already own with root privileges. So most of the users are unaffected by this exploit.
> These days most common use case of ssh is logging in to a remote server you already own with root privileges
I only see this in relatively small and "young" teams. In any bigger organization I've worked in, a new user is created for each person who uses the machine.
Re: OpenSSH Race condition resulting in potential remote code execution
#10>A critical vulnerability in sshd(8) was present in Portable OpenSSH versions between 8.5p1 and 9.7p1 (inclusive) that may allow arbitrary code execution with root privileges. FYI that's every version published after 2021-03-03 That's got to be 99% of all linux machines in the world with an ssh daemon running right? https://www.openssh.com/releasenotes.html
Using this exploit, connected non root users can gain root access. Multiple user machines are more or less a thing of the past. These days most common use case of ssh is logging in to a remote server you already own with root privileges. So most of the users are unaffected by this exploit.
Are you sure? The text implies that the unsafe path is getting interrupted while parsing a DSA key, which presumably occurs before authentication?