Security bugs are reported here via bugzilla

[Seth Woolley <seth AT tautology.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I'm replying back on list since I found another link..., hope you don't
mind Niki.

There was a reply on full-disclosure, but after analyzing it, I'm
hard-pressed to see anything inherently wrong with the code as long as
the buffer->offset is sane before it is passed to the function.  I think
we're being taken for a ride.  Niki and I talked in irc, and we'll keep
watching it for any movement.  Anybody else is welcome to comment.  I'm
seriously having my doubts though.  This is one of those things that
PaX/grsecurity would prevent anyways, and priv-sep possibly, depending on
where the code was run.  I'm also confused that the original post
mentioning 3.6p?, we're on 3.6 _point one_ p2 (3.6.1p2)...  so I'm even
more confused.  Without official word from Theo, I'm very inclined to
ignore.

http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=106367504602779&w=2

See that as well... the openssh people now know about the posts too, so
I'm going to watch that as well.

Seth

On Tue, 16 Sep 2003, Niki Guldbrand wrote:

> Hey Seth.
>
> What is all this about ??
>
> How serius is it ? (Have not heard anything other than what i have read
> here.)
>
> And is it only patchlevel 1 that has it ?
>
>
> Best Regards
>
> Niki
>
> On Tue, 2003-09-16 at 03:40, Seth Woolley wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > New vuln?  Full Disclosure has two threads so far:
> > http://lists.netsys.com/pipermail/full-disclosure/2003-September/010103.html
> > http://lists.netsys.com/pipermail/full-disclosure/2003-September/010135.html
> >
> > The second one is of note.  See anything there that I don't?  I'm waiting
> > for a response to the second thread for confirmation.
> >
> > But we're on 3.6.1p2 right now... think we're safe?
> >
> > Seth
> >
> > On Mon, 15 Sep 2003, Craig Van Tassle wrote:
> >
> > > There has been some reports of a new vuln for openssh 3.6p1.  As far as
> > > I know the vuln is only for 3.6p1 and 3.6p2 is save.
> > >
> > >
> > > _______________________________________________
> > > SM-Security mailing list
> > > SM-Security AT lists.ibiblio.org
> > > http://lists.ibiblio.org/mailman/listinfo/sm-security
> >
> > - --
> > Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
> > Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
> > Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.2.2 (FreeBSD)
> >
> > iD8DBQE/Zmoq7fQ833vqzH0RAuw1AKCrBfCOYisWUqMUhfNDP1hA1KSZyACfQvlZ
> > jORXgBQ76UAyc8GjA/imHmE=
> > =X8Ca
> > -----END PGP SIGNATURE-----
> >
> > _______________________________________________
> > SM-Security mailing list
> > SM-Security AT lists.ibiblio.org
> > http://lists.ibiblio.org/mailman/listinfo/sm-security
>

- --
Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (FreeBSD)

iD8DBQE/ZpMq7fQ833vqzH0RApKFAJ9y/wJQrprbfrgEqokQFsOfWJStugCg1w4h
NZ5UEdisp4HVzrxUoUE550s=
=x/+s
-----END PGP SIGNATURE-----