uh-oh, openSSH vulnarebility

neo77777 · 06-24-2002, 09:53 PM

Hi everyone, I just came across another interesting article on linuxsecurity.org
http://linuxsecurity.org/articles/cr...icle-5185.html
Hope the hole will be patched ASAP.

unSpawn · 06-25-2002, 06:37 AM

Yeah, hope so too, but it's weird only Engarde, Mandrake and Debian have taken the time to issue statements about this (apart from the vuln/dev world).
This law thing, that led to the world being drawn into full and non-disclosure camps, you gotta hate it. Especially since ISS where the ones that went nuclear on the Apache chunking thingie, maybe we should see this behaviour of non-disclosure to be a D0S on developer resources itself :-[

neo77777 · 06-25-2002, 12:38 PM

Yep, as it is claimed in the e-mail developers at RH, SuSE, etc have already wasted time, I hope it won't grow in the familiar MS statement like there is no security breach in UPnP, and IE is as secure as it must be, remember their claim that potential of IE verifying a file nature is just looking on three letter extension, and MS claimed that there is nothing wrong with it.