4 ms·

Has OpenSSH ever had a vulnerability that has led to unauthorized login access? That would be a huge problem. I don’t care about DoS or crashes!

by aborsy 4y ago

loloquwowndueo 4y ago
Yes. https://en.m.wikipedia.org/wiki/OpenBSD#Security_record https://en.m.wikipedia.org/wiki/OpenBSD#Security_record
binkHN 4y ago
Per http://www.openbsd.org http://www.openbsd.org, “Only two remote holes in the default install, in a heck of a long time!” I believe, at least one of these, was SSH related.
- asveikau 4y ago
  They switched to "heck of a long time" because they had that blurb of text since the 90s. So we're talking about 2 holes in about 25 years. Though I think I heard some criticism of what counts and what does not for that tally, maybe 20 years ago. The project was fairly innovative of including now-standard practices like having the daemon drop its privileges.
  - bombcar 4y ago
    Iirc the criticism was that the default install has no services enabled basically.
    - IcePic 4y ago
      Yeah, people in the 90s really loved installing redhat 4 (not rhel 4, the old versions) and getting a vulnerable pop2/pop3/imapd running by default after installs. You would get hacked within the hour if not behind firewalls. Very unfair of OpenBSD (and other security conscious OSes) to not compete on equal terms there.
bawolff 4y ago
How else would trinity hack the power plant in the matrix!
- px43 4y ago
  Yup CVE-2001-0144 https://nvd.nist.gov/vuln/detail/CVE-2001-0144 https://nvd.nist.gov/vuln/detail/CVE-2001-0144 https://www.youtube.com/watch?app=desktop&v=0PxTAn4g20U https://www.youtube.com/watch?app=desktop&v=0PxTAn4g20U
  - acdha 4y ago
    I remember people started probing pretty quickly, too, which was a good warning that you couldn’t be complacent about things like that. If memory serves, we’d upgraded most of our servers to only support SSH-2 before this happened and since that included our public shell servers (.edu) nobody broke in to anything but we did have to badger some proprietary vendors for updates to devices which were fortunately on our restricted internal-only network.
- LinuxBender 4y ago
  When that first showed in theaters in the bay area, people cheered and clapped when she was using Nmap and SSH Nuke. Non tech folks were probably a little confused.
  - ianmcgowan 4y ago
    There were dozens of us, dozens! It was a relatively recent exploit, I remember being at an RSA conference when the remote ssh exploit was announced and everyone’s pager started going off and people hustled out of there. Fun times!
  - amrb 4y ago
    It's on their site too xD https://nmap.org/movies/ https://nmap.org/movies/
0x0 4y ago
Another example - where OpenSSH itself was not to blame, but rather PAM - was the old https://www.debian.org/security/2002/dsa-177 https://www.debian.org/security/2002/dsa-177 Where locked accounts were treated as password-less accounts, and would allow direct ssh access. In Debian's defence, this was caught in the unstable distro and never made it out to a stable release.
fgh 4y ago
Team TESO wrote an excellent exploit back in the day - one of the best groups of the early 2000s.
outworlder 4y ago
> I don’t care about DoS or crashes! Be very, very concerned with any vulnerabilities that cause crashes. Someone may discover a way to control where the process points to, and now you have a way more serious issue.
- flatiron 4y ago
  For else old folks it would be like WinNuke. Back in the day of dial up your entire PC was front and center on the internet. Windows 95 had a vulnerability that anyone could BSOD you. When it came out basically any IRC or multiplayer interaction you could get BSOD’d by any rando on the internet. I would be lying if I wasn’t occasionally on the sending end of these at the ripe old age of 12.
  - int_19h 4y ago
    It could get much worse than a BSOD. Also from this era: http://bash.org/?117002 http://bash.org/?117002
ranger_danger 4y ago
in certain cases crashes can be used to gain login access

Has OpenSSH ever had a vulnerability that has led to unauthorized login access? That would be a huge problem. I don’t care about DoS or crashes!

by aborsy 4y ago

Has OpenSSH ever had a vulnerability that has led to unauthorized login access? That would be a huge problem. I don’t care about DoS or crashes!

loloquwowndueo 4y ago

Yes. https://en.m.wikipedia.org/wiki/OpenBSD#Security_record https://en.m.wikipedia.org/wiki/OpenBSD#Security_record

binkHN 4y ago

Per http://www.openbsd.org http://www.openbsd.org, “Only two remote holes in the default install, in a heck of a long time!” I believe, at least one of these, was SSH related.

asveikau 4y ago
They switched to "heck of a long time" because they had that blurb of text since the 90s. So we're talking about 2 holes in about 25 years. Though I think I heard some criticism of what counts and what does not for that tally, maybe 20 years ago. The project was fairly innovative of including now-standard practices like having the daemon drop its privileges.
- bombcar 4y ago
  Iirc the criticism was that the default install has no services enabled basically.
  - IcePic 4y ago
    Yeah, people in the 90s really loved installing redhat 4 (not rhel 4, the old versions) and getting a vulnerable pop2/pop3/imapd running by default after installs. You would get hacked within the hour if not behind firewalls. Very unfair of OpenBSD (and other security conscious OSes) to not compete on equal terms there.

bawolff 4y ago

How else would trinity hack the power plant in the matrix!

px43 4y ago
Yup CVE-2001-0144 https://nvd.nist.gov/vuln/detail/CVE-2001-0144 https://nvd.nist.gov/vuln/detail/CVE-2001-0144 https://www.youtube.com/watch?app=desktop&v=0PxTAn4g20U https://www.youtube.com/watch?app=desktop&v=0PxTAn4g20U
- acdha 4y ago
  I remember people started probing pretty quickly, too, which was a good warning that you couldn’t be complacent about things like that. If memory serves, we’d upgraded most of our servers to only support SSH-2 before this happened and since that included our public shell servers (.edu) nobody broke in to anything but we did have to badger some proprietary vendors for updates to devices which were fortunately on our restricted internal-only network.
LinuxBender 4y ago
When that first showed in theaters in the bay area, people cheered and clapped when she was using Nmap and SSH Nuke. Non tech folks were probably a little confused.
- ianmcgowan 4y ago
  There were dozens of us, dozens! It was a relatively recent exploit, I remember being at an RSA conference when the remote ssh exploit was announced and everyone’s pager started going off and people hustled out of there. Fun times!
- amrb 4y ago
  It's on their site too xD https://nmap.org/movies/ https://nmap.org/movies/

0x0 4y ago

Another example - where OpenSSH itself was not to blame, but rather PAM - was the old https://www.debian.org/security/2002/dsa-177 https://www.debian.org/security/2002/dsa-177 Where locked accounts were treated as password-less accounts, and would allow direct ssh access. In Debian's defence, this was caught in the unstable distro and never made it out to a stable release.

fgh 4y ago

Team TESO wrote an excellent exploit back in the day - one of the best groups of the early 2000s.

outworlder 4y ago

> I don’t care about DoS or crashes! Be very, very concerned with any vulnerabilities that cause crashes. Someone may discover a way to control where the process points to, and now you have a way more serious issue.

flatiron 4y ago
For else old folks it would be like WinNuke. Back in the day of dial up your entire PC was front and center on the internet. Windows 95 had a vulnerability that anyone could BSOD you. When it came out basically any IRC or multiplayer interaction you could get BSOD’d by any rando on the internet. I would be lying if I wasn’t occasionally on the sending end of these at the ripe old age of 12.
- int_19h 4y ago
  It could get much worse than a BSOD. Also from this era: http://bash.org/?117002 http://bash.org/?117002

ranger_danger 4y ago

in certain cases crashes can be used to gain login access