sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

[SM-Security] OpenSSH/PAM timing attack

From: Ladislav Hagara <hgr AT vabo.cz>
To: sm-security AT lists.ibiblio.org
Subject: [SM-Security] OpenSSH/PAM timing attack
Date: Sat, 03 May 2003 18:40:46 +0200

Howdy security gurus !!!

According to http://lab.mediaservice.net/advisory/2003-01-openssh.txt
there is a bug in openssh.
openssh in test and stable grimoire needs to be updated.

openssh in devel grimoire is updated already (p4 change 11908).

- lace -

Example Attack Session:

root@voodoo:~# ssh [valid_user]@lab.mediaservice.net
[valid_user]@lab.mediaservice.net's password: <- arbitrary (non-null)
string
[2 secs delay]
Permission denied, please try again.

root@voodoo:~# ssh [no_such_user]@lab.mediaservice.net
[no_such_user]@lab.mediaservice.net's password: <- arbitrary (non-null)
string
[no delay]
Permission denied, please try again.

[SM-Security] OpenSSH/PAM timing attack, Ladislav Hagara, 05/03/2003
- Re: [SM-Security] OpenSSH/PAM timing attack, Seth Woolley, 05/03/2003