On Tue, 06 May 2003 at 05:47:37PM +0200, Diederik de Vries wrote: > Hi there! Greets, > > Today I was surfing on SecurityFocus, and saw that there was a hole in > OpenSSH (http://www.securityfocus.com/bid/7482/info/). Debian Potato > uses OpenSSH 3.1 p1, which seems to be exploitable. > > Is this true, am I missing something or what? > It is a small vulnerability. The same information can be gathered from your MTA (if you are running one) by doing an RCPT TO: and then an RSET. I consider turning off the delay more of a security risks since it allows the attacker to brute force the password quicker. *shrugs*. I wouldn't loose any sleep over it, I have not changed my pam because of it, nor do I plan to. Take Care, -- Phillip Hofmeister Network Administrator/Systems Engineer IP3 Inc. http://www.ip3security.com PGP/GPG Key: http://www.zionlth.org/~plhofmei/ wget -O - http://www.zionlth.org/~plhofmei/key.txt | gpg --import -- Excuse #136: le0: no carrier: transceiver cable problem?
Attachment:
pgpUG5ArN4Vx_.pgp
Description: PGP signature