Security bugs are reported here via bugzilla

[Seth Woolley <seth AT tautology.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In test and stable now.  I also posted a news announcement:
http://news.sourcemage.org/article.php?story=20030503141550869

Thanks,

Seth

On Sat, 3 May 2003, Ladislav Hagara wrote:

> Howdy security gurus !!!
>
> According to http://lab.mediaservice.net/advisory/2003-01-openssh.txt
> there is a bug in openssh.
> openssh in test and stable grimoire needs to be updated.
>
> openssh in devel grimoire is updated already (p4 change 11908).
>
> - lace -
>
>
> Example Attack Session:
>
> root@voodoo:~# ssh [valid_user]@lab.mediaservice.net
> [valid_user]@lab.mediaservice.net's password: <- arbitrary (non-null)
> string
> [2 secs delay]
> Permission denied, please try again.
>
> root@voodoo:~# ssh [no_such_user]@lab.mediaservice.net
> [no_such_user]@lab.mediaservice.net's password: <- arbitrary (non-null)
> string
> [no delay]
> Permission denied, please try again.
>
>
>
>
> _______________________________________________
> SM-Security mailing list
> SM-Security AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-security
>

- --
Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (FreeBSD)

iD8DBQE+tAmk7fQ833vqzH0RAmhdAKCl6xPBbwdMUqDtgRsgu4APTxuheACeLeBX
tKBZeBo+PkhW3+Mz8xO0FgU=
=+NSJ
-----END PGP SIGNATURE-----