APM: Critical Exploit

Jason Bodnar jason at shakabuku.org
Wed Jun 26 17:27:21 CDT 2002

Some info from Mandrake:

MandrakeSoft Security Advisory
Package name openssh
Date June 24th, 2002
Advisory ID MDKSA-2002:040
Affected versions 7.1, 7.2, 8.0, 8.1, 8.2, Corporate Server 1.0.1, Single
Network Firewall 7.2
Update Type Security

Problem Description:

Details of an upcoming OpenSSH vulnerability will be published early next
week. According to the OpenSSH team, this remote vulnerability cannot be
exploited when sshd is running with privilege separation. The priv separation
code is significantly improved in version 3.3 of OpenSSH which was released on
June 21st. Unfortunately, there are some known problems with this release;
compression does not work on all operating systems and the PAM support has not
been completed.

The OpenSSH team encourages everyone to upgrade to version 3.3 immediately and
enable privilege separation. This can be enabled by placing in your
/etc/ssh/sshd_config file the following:

      UsePrivilegeSeparation yes

The vulnerability that will be disclosed next week is not fixed in version 3.3
of OpenSSH, however with priv separation enabled, you will not be vulnerable
to it. This is because privilege separation uses a separate non-privileged
process to handle most of the work, meaning that any vulnerability in this
part of OpenSSH will never lead to a root compromise. Only access as the
non-privileged user restricted in chroot would be available.

MandrakeSoft encourages all of our users to upgrade to the updated packages
immediately. This update creates a new user and group on the system named sshd
that is used to run the non-privileged processes.

Jason Bodnar
jason at shakabuku.org

More information about the Austin mailing list