3 ms·
OpenSSH client side vulnerability CVE-2016-0777 fixed in upcoming 7.1p2 release
- jlgaddis 11y agoWorkaround (yes, it's client-side): # echo "UseRoaming no" >> /etc/ssh/ssh_config MITM or session hijack, perhaps?
- Piskvorrr 11y ago"The authentication of the server host key prevents exploitation by a man-in-the-middle, so this information leak is restricted to connections to malicious or compromised servers." http://lists.mindrot.org/pipermail/openssh-unix-dev/2016-January/034680.html http://lists.mindrot.org/pipermail/openssh-unix-dev/2016-Jan...
- Piskvorrr 11y agoBtw, there will be some clumsy-admin fallout, as putting this into sshd_config by mistake will cause a running-but-unreachable SSH daemon. (Guess how I found out ;))
- Aissen 11y agoAffects 5.4 - 7.1 (quite a lot of releases): http://undeadly.org/cgi?action=article&sid=20160114142733 http://undeadly.org/cgi?action=article&sid=20160114142733