7 ms·
Does SSH (specifically sshd) on major OSes use affected versions of OpenSSL? [answer pulled up from replies below: since sshd doesn't use TLS protocol, it isn't
by gojomo 13y ago
Does SSH (specifically sshd) on major OSes use affected versions of OpenSSL? [answer pulled up from replies below: since sshd doesn't use TLS protocol, it isn't affected by this bug, even if it does use affected OpenSSL versions]
What's the quickest check to see if sshd, or any other listening process, is vulnerable?
(For example, if "lsof | grep ssl" only shows 0.9.8-ish version numbers, is that a good sign?)
- tptacek 13y agoThe bug is in the handling of the TLS protocol itself (actually, in a little-used extension of TLS, the TLS Record Layer Heartbeat Protocol), and isn't exposed in applications that just use TLS for crypto primitives.
- gojomo 13y agoDoes sshd only use TLS/OpenSSL "for crypto primitives"? Or not use OpenSSL at all?
- tptacek 13y agosshd implements the SSH protocol, not the TLS protocol.
- jlgaddis 13y agoWhat about when using certificates?
- andrewcooke 13y agowhen openssh uses certificates it still uses its own protocol (even with the x509 patch - without that, the certificates used by openssh are not even the same kind of certificate as those used by openssl). the problem with the openssl library is in the implementation of the TLS protocol. this is not used by openssh. so openssh is not affected by this problem. even when certificates are used. and even when x509 certificates are used (which requires a separate patch).
- ominous_prime 13y agoTLS is a protocol, OpenSSL is a library, sshd uses the latter to implement the SSH protocol.
- whyleyc 13y agoSooo in layman's terms - we only need to be worrying about HTTPS and not SSH ?
- amalcon 13y agoNot only HTTPS. Many other protocols are TLS-based: modern email, some VPNs, etc. Really almost everything secret on the Internet is protected by TLS; SSH is a rare exception.
- aegiso 13y agoYes and no. First off, TLS is crypto bread-and-butter that's used for a lot more than HTTPS. You're not out of the woods because you're not running a webserver. Second, SSH itself doesn't use TLS; it has its own protocol, so sshd isn't vulnerable. But third, read overflows like this can be escalated in countless ways to total compromise if some credential, key, canary, or such gets leaked. So just because sshd isn't vulnerable doesn't mean you're not screwed.
- rurban 13y agoIf it would be that easy. ssh not, but all those. Some of them actually use the heartbeat feature. curl seems to be the worst. $ apt-cache showpkg libssl1.0.0 => http://perl514.cpanel.net/libssl1.0.0.depends http://perl514.cpanel.net/libssl1.0.0.depends (186 deps)
- dfc 13y agoI am having a lot of trouble figuring out what you were attempting to convey in the first four sentences in your comment. The one thing that I can discern is that you printed a list of every package that depends on libssl1.0.0 for your configured repositories. But you have no idea if those programs make use of heartbeat. ssh (and everything related like libpam-ssh) is on that list and does not use TLS. The same can be said for many others such as tpm-tools, ntp/ntpdate/openntpd, xca and so on.
- sliverstorm 13y agoOk, so is TLS Heartbeat accessible in every service that uses TLS? The big one that comes to mind aside from https is smtp/tls, e.g. port 587 Edit: Apparently a PoC on STARTTLS has already been written, so smtp/tls is definitely vulnerable