Mail Archives: cygwin/2000/05/30/15:12:57
Yes, that is the error I am trying to resolve... but after digging through
the OpenSSL source.... is RSAREF compiled in, or is it using SSLeay? Or
does it matter? *grin*
-----Original Message-----
From: Richard Hitt [mailto:rbh00 AT netcom DOT com]
Sent: Tuesday, May 30, 2000 3:02 PM
To: Prentis Brooks
Subject: Re: [ANNOUNCEMENT]: patched openSSH-1.2.2 [was Re: No this has
a nasty bite]
Hi All
I came across what might be a related URL:
http://www.ssh.com/products/ssh/patches/patch-ssh-1.2.27-rsaref.buffer.overf
low
hth
Richard
On Tue, 30 May 2000 14:19:27 -0400, you wrote:
>Corinna,
> your patches work great, one last quick question, then I am done, I hope
>:). There is apparently an RSAREF patch out there with a buffer overflow
>problem, I am still trying to track down the patch number. If you happen
to
>know of it, did you apply that patch to the OpenSSL code? If you don't
know
>of the one I am talking about, then I guess there is not much we can do
>until I find that patch number ;)
>
>Thanks
>
>-----Original Message-----
>From: cygwin-owner AT sourceware DOT cygnus DOT com
>[mailto:cygwin-owner AT sourceware DOT cygnus DOT com]On Behalf Of Corinna Vinschen
>Sent: Sunday, May 28, 2000 5:25 AM
>To: Prentis Brooks
>Cc: cygwin
>Subject: Re: [ANNOUNCEMENT]: patched openSSH-1.2.2 [was Re: No this has
>a nasty bite]
>
>
>Prentis Brooks wrote:
>> different from what I was looking to do. Would you mind telling me how
>you
>> solved the problem of unauthorized access to a another account?
>> (specifically, being able to login to RSA enabled SSHD eventhough your
RSA
>> key is not part of that SSHD's user's authorized_key file.)
>
>Password authentication leads to a valid hToken, any
>other authentication leads to hToken == INVALID_HANDLE_VALUE.
>So after authentication I check for non-password authentication
>and equality of getuid() to uid of authenticated user.
>
>==== SNIP ====
>@@ -1498,6 +1529,13 @@ do_authloop(struct passwd * pw)
> break;
> }
>
>+#ifdef __CYGWIN__
>+ if (is_winnt && hToken == INVALID_HANDLE_VALUE &&
>+ authenticated && getuid() != pw->pw_uid) {
>+ packet_disconnect("Authentication rejected for
>uid %d.", (int) pw->pw_uid);
>+ authenticated = 0;
>+ }
>+#endif
> /* Raise logging level */
> if (authenticated ||
> attempt == AUTH_FAIL_LOG ||
>==== SNAP ====
>
>Corinna
>
>--
>Corinna Vinschen
>Cygwin Developer
>Cygnus Solutions, a Red Hat company
>
>--
>Want to unsubscribe from this list?
>Send a message to cygwin-unsubscribe AT sourceware DOT cygnus DOT com
--
Want to unsubscribe from this list?
Send a message to cygwin-unsubscribe AT sourceware DOT cygnus DOT com
- Raw text -