OpenSSH security advisory for vulnerability?

R

ralphbsz

Release from OpenSSH is here: https://www.openssh.com/txt/release-9.8

In a nutshell, it says that OpenSSH versions on OSes other than OpenBSD are vulnerable, up to version 9.7p1; version 9.8 is safe. The vulnerability is very slow: on a 32-bit Linux system with address space randomization (ASLR), the attack has actually be demonstrated, and takes 6-8 hours. It looks like 64-bit systems make it harder, while lack of ASLR makes it easier.

Good news: ASLR is enabled starting with FreeBSD 13.2, and I'm running 13.3. More good news: All my machines are now 64 bit.

Bad news: My OpenSSH version in 13.3-RELEASE-p3 is 9.6p1, so it is vulnerable.

I assume a FreeBSD update will be showing up very soon?

I guess I should start to worry about the fact that my internet-connected server is getting several thousand failed ssh attempts per day, all coming from the same IP address, in Vientiane (if you don't know about geography, look it up; supposedly it is a very beautiful city, in a country run by a not very beautiful government). Time to do that pf project that has been on the back burner for months.
 
There was a FreeBSD security update today, it was on these forums as well. But, if you'll forgive me sounding like a nag, it's a good thing to subscribe to FreeBSD security. It's a low volume list and they give security updates when one is discovered.
In this case, they give ways to patch the problem, either with FreeBSD update or with a source patch.

Here's the forum post:
forums.freebsd.org

FreeBSD-SA-24:04.openssh

A signal handler in sshd(8) calls a function that is not async-signal-safe. The signal handler is invoked when a client does not authenticate within the LoginGraceTime seconds (120 by default). This signal handler executes in the context of the sshd(8)'s privileged code, which is not sandboxed...
forums.freebsd.org forums.freebsd.org

And here's info on subscribing to FreeBSD-security. Again it is a VERY low volume list, you won't be receiving many emails from them.

 
You must log in or register to reply here.
Back
Top