regreSShion ? Says FreeBSD is not affected.

[GlitchyDot]

'Critical' vulnerability in OpenSSH uncovered, affects almost all Linux systems
Do you feel lucky F(reeBSD)unk ? )))

 

[richardtoohey2]

See:

OpenSSH security advisory for vulnerability?

Release from OpenSSH is here: https://www.openssh.com/txt/release-9.8 In a nutshell, it says that OpenSSH versions on OSes other than OpenBSD are vulnerable, up to version 9.7p1; version 9.8 is safe. The vulnerability is very slow: on a 32-bit Linux system with address space randomization...

forums.freebsd.org

... for more information.

 

[SirDice]

https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc

 

[cracauer@]

So what's the deal with that glibc-only talk?

 

[CyberCr33p]

Is it possible to do:


gitup release
cd /usr/src/secure/lib/libssh
make all
make install
service sshd restart


Will this patch the issue?

 

[sean137]

So what's the deal with that glibc-only talk?

https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt

"This vulnerability is exploitable remotely on glibc-based Linux systems, where syslog() itself calls async-signal-unsafe functions ... We have not investigated any other libc or operating system; but OpenBSD is notably not vulnerable, because its SIGALRM handler calls syslog_r(), an async-signal-safer version of syslog() that was invented by OpenBSD in 2001."

 

[CyberCr33p]


gitup release
cd /usr/src/secure/usr.sbin/sshd
make all
make install
service sshd restart


Before running these commands, the server version was "OpenSSH_9.6 FreeBSD-20240104," and after executing them, the server version updated to "OpenSSH_9.6 FreeBSD-20240701."

Is this the correct procedure?

 

[cracauer@]

https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt

"This vulnerability is exploitable remotely on glibc-based Linux systems, where syslog() itself calls async-signal-unsafe functions ... We have not investigated any other libc or operating system; but OpenBSD is notably not vulnerable, because its SIGALRM handler calls syslog_r(), an async-signal-safer version of syslog() that was invented by OpenBSD in 2001."

Hmmm. I wonder about my Macs. Apple didn't release a patch so far, I wonder whether one is coming.

 

[PMc]

Noticed that one yesterday on our main page (and worked myself thru the docs).
I don't think FreeBSD is not affected (only OpenBSD is apparently not affected), however the exploit paths as documented by Qualys may not work for FreeBSD, so people may have to search for some exploit paths that can work on FreeBSD. Anyway it's not funny.

It will take some time to break in, and I think one will see a number above 0 here while somebody tries:
10966 - IsJ 0:00.00 sshd: /usr/sbin/sshd [listener] 0 of 5-5 startups (