Skip to Content.
Sympa Menu

sm-security - Re: [SM-Security] OpenSSH/PAM timing attack

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Seth Woolley <seth AT tautology.org>
  • To: Ladislav Hagara <hgr AT vabo.cz>
  • Cc: sm-security AT lists.ibiblio.org
  • Subject: Re: [SM-Security] OpenSSH/PAM timing attack
  • Date: Sat, 3 May 2003 11:25:27 -0700 (PDT)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In test and stable now. I also posted a news announcement:
http://news.sourcemage.org/article.php?story=20030503141550869

Thanks,

Seth

On Sat, 3 May 2003, Ladislav Hagara wrote:

> Howdy security gurus !!!
>
> According to http://lab.mediaservice.net/advisory/2003-01-openssh.txt
> there is a bug in openssh.
> openssh in test and stable grimoire needs to be updated.
>
> openssh in devel grimoire is updated already (p4 change 11908).
>
> - lace -
>
>
> Example Attack Session:
>
> root@voodoo:~# ssh [valid_user]@lab.mediaservice.net
> [valid_user]@lab.mediaservice.net's password: <- arbitrary (non-null)
> string
> [2 secs delay]
> Permission denied, please try again.
>
> root@voodoo:~# ssh [no_such_user]@lab.mediaservice.net
> [no_such_user]@lab.mediaservice.net's password: <- arbitrary (non-null)
> string
> [no delay]
> Permission denied, please try again.
>
>
>
>
> _______________________________________________
> SM-Security mailing list
> SM-Security AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-security
>

- --
Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (FreeBSD)

iD8DBQE+tAmk7fQ833vqzH0RAmhdAKCl6xPBbwdMUqDtgRsgu4APTxuheACeLeBX
tKBZeBo+PkhW3+Mz8xO0FgU=
=+NSJ
-----END PGP SIGNATURE-----





Archive powered by MHonArc 2.6.24.

Top of Page