[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: ***DEB*: Set the way-back machine to OpenSSH 1.2.1

> --------------------------------------------------
> Let's say, hypothetically, that I happen to be responsible for a machine  
> running OpenSSH 1.2.1.  I checked, and it's not vulnerable to the recent  
> xmalloc() overflow seen on versions 3.x.
> Are there any known *remote* root exploits on this version?  I realize lack 
> of maintenance is a problem, but upgrading to 3.4 isn't really possible for 
> several reasons.

My suggestion would be: FIREWALL.
Only allow the (trusted!) machines that need access to ssh and block the others.
This would only work when there are just a few accounts that need shell access.

  :) - Joost.

To UNSUBSCRIBE, email to debian-security-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Reply to: