7 ms·

This is the second time Devin changes to ssh have led to vulnerabilities.

by influx 3y ago

cpach 3y ago
?
- fragmede 3y ago
  CVE-2008-0166 It was really bad. https://github.com/g0tmi1k/debian-ssh https://github.com/g0tmi1k/debian-ssh
  - deleted 3y ago
    [deleted]
  - cpach 3y ago
    Yes I know that one. But I don’t really see a conection still. The xz backdoor was not introduced by Debian, it was introduced by a bad faith actor via the xz project (aka liblzma). Not only Debian was affected, Fedora was too. AFAIK there is no evidence that CVE-2008-0166 was done deliberately, whereas with the xz backdoor, there seems to be lots of signs of deliberate intent.
    - armitron 3y ago
      The backdoor was possible because Debian introduced a dependency into sshd, libsystemd, which in turn linked to liblzma. Official sshd does not have a systemd dependency in the same way that official sshd back in 2008 did not suffer from a predictable PRNG. Debian is also 100% at fault here and I hope this slap in the face makes them reconsider their poor security practices. Amateur package maintainers should not be overstepping their job (packaging) and enabling disastrous vulnerabilities in security-critical software.
      - cpach 3y ago
        You have a point there. For the record, Fedora was affected too.
      - cesarb 3y ago
        That's ridiculous. Adding the dependency to libsystemd in no way created any vulnerability. Even the indirect dependency on liblzma didn't add any vulnerability. It took a separate malicious maintainer doing a later change to liblzma so that it ran code when the library was loaded to create the vulnerability.
        armitron 3y ago
        I wrote 'was possible' and 'enabled', not 'created'. By paying more attention to what others write you'll avoid superficial dismissals that prevent you from improving your understanding of complex issues. The creation of this backdoor did not take place in a vacuum. Can you imagine the same person trying to introduce build changes and binary test cases into openssh? This backdoor was crafted in this particular way _specifically_ to exploit the fact that sshd in distributions such as Debian is being indirectly linked with lzma.
      - throwaway7356 3y ago
        > Amateur package maintainers should no [...] At least there is no lack of amateur enthusiasts telling people how they are wrong. :)
rurban 3y ago
Never trust Devin. Should have been clear from the first Debian-specific "improvement", which brought us the first ssh mess. systemd notifications are much easier to get than linking to it, and thus enabling such a backdoor. Amateurs shouldnt mess with critical security infra, esp. Debian's
- cpach 3y ago
  What does Devin have to do with xz?
  - rurban 3y ago
    Not much. He just applied the debian-specfic systemd-notify patch to ssh to enable this xz backdoor. As he did with the previous debian ssh desaster, breaking it the last time.

This is the second time Devin changes to ssh have led to vulnerabilities.

by influx 3y ago

This is the second time Devin changes to ssh have led to vulnerabilities.

cpach 3y ago

fragmede 3y ago
CVE-2008-0166 It was really bad. https://github.com/g0tmi1k/debian-ssh https://github.com/g0tmi1k/debian-ssh
- deleted 3y ago
  [deleted]
- cpach 3y ago
  Yes I know that one. But I don’t really see a conection still. The xz backdoor was not introduced by Debian, it was introduced by a bad faith actor via the xz project (aka liblzma). Not only Debian was affected, Fedora was too. AFAIK there is no evidence that CVE-2008-0166 was done deliberately, whereas with the xz backdoor, there seems to be lots of signs of deliberate intent.
  - armitron 3y ago
    The backdoor was possible because Debian introduced a dependency into sshd, libsystemd, which in turn linked to liblzma. Official sshd does not have a systemd dependency in the same way that official sshd back in 2008 did not suffer from a predictable PRNG. Debian is also 100% at fault here and I hope this slap in the face makes them reconsider their poor security practices. Amateur package maintainers should not be overstepping their job (packaging) and enabling disastrous vulnerabilities in security-critical software.
    - cpach 3y ago
      You have a point there. For the record, Fedora was affected too.
    - cesarb 3y ago
      That's ridiculous. Adding the dependency to libsystemd in no way created any vulnerability. Even the indirect dependency on liblzma didn't add any vulnerability. It took a separate malicious maintainer doing a later change to liblzma so that it ran code when the library was loaded to create the vulnerability.
      - armitron 3y ago
        I wrote 'was possible' and 'enabled', not 'created'. By paying more attention to what others write you'll avoid superficial dismissals that prevent you from improving your understanding of complex issues. The creation of this backdoor did not take place in a vacuum. Can you imagine the same person trying to introduce build changes and binary test cases into openssh? This backdoor was crafted in this particular way _specifically_ to exploit the fact that sshd in distributions such as Debian is being indirectly linked with lzma.
    - throwaway7356 3y ago
      > Amateur package maintainers should no [...] At least there is no lack of amateur enthusiasts telling people how they are wrong. :)

rurban 3y ago

Never trust Devin. Should have been clear from the first Debian-specific "improvement", which brought us the first ssh mess. systemd notifications are much easier to get than linking to it, and thus enabling such a backdoor. Amateurs shouldnt mess with critical security infra, esp. Debian's

cpach 3y ago
What does Devin have to do with xz?
- rurban 3y ago
  Not much. He just applied the debian-specfic systemd-notify patch to ssh to enable this xz backdoor. As he did with the previous debian ssh desaster, breaking it the last time.