Mailing-List: contact cygwin-help AT sourceware DOT cygnus DOT com; run by ezmlm
List-Subscribe: <mailto:cygwin-subscribe AT sources DOT redhat DOT com>
List-Archive: <http://sources.redhat.com/ml/cygwin/>
List-Post: <mailto:cygwin AT sources DOT redhat DOT com>
List-Help: <mailto:cygwin-help AT sources DOT redhat DOT com>, <http://sources.redhat.com/ml/#faqs>
Sender: cygwin-owner AT sources DOT redhat DOT com
Delivered-To: mailing list cygwin AT sources DOT redhat DOT com
Date: Fri, 9 Feb 2001 08:40:18 +0100
From: Corinna Vinschen <cygwin AT cygwin DOT com>
To: cygwin <cygwin AT cygwin DOT com>
Subject: Authentication By-Pass Vulnerability in OpenSSH 2.3.1 (devel snapshot) (fwd)
Message-ID: <20010209084018.C4880@cygbert.vinschen.de>
Mail-Followup-To: cygwin <cygwin AT cygwin DOT com>
Mime-Version: 1.0
Content-Type: text/PLAIN; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i

FYI for those running snapshots.  I have removed the openssh-20010202
snapshot from cygwin/latest.

If you are using the openssh-20010202 snapshot PLEASE REVERT BACK TO
openssh-20001221 OR openssh-2.3.0p1.!!!

Corinna

---------- Forwarded message ----------
Date: Thu, 08 Feb 2001 18:15:00 -0500
From: Niels Provos <provos AT citi DOT umich DOT edu>
To: security-announce AT openbsd DOT org
Subject: Authentication By-Pass Vulnerability in OpenSSH 2.3.1 (devel
    snapshot)

----------------------------------------------------------------------------

                        OpenBSD Security Advisory

                            February 8, 2001

             Authentication By-Pass Vulnerability in OpenSSH-2.3.1

----------------------------------------------------------------------------

SYNOPSIS

OpenSSH-2.3.1, a development snapshot, only checked if a public key
for public key authentication was permitted.  In the protocol 2 part
of the server, the challenge-response step that ensures that the
connecting client is in possession of the corresponding private key
has been omitted. As a result, anyone who could obtain the public key
listed in the users authorized_keys file could log in as that user
without authentication.

A fix for this problem was committed on Februrary 8th.  The problem
was introduced on January 18th.  This is a three week time window.

----------------------------------------------------------------------------

AFFECTED SYSTEMS

This vulnerability affects only OpenSSH version 2.3.1 with support for
protocol 2 enabled.  The latest official release OpenSSH 2.3.0 is not
affected by this problem.  The latest snapshot version OpenSSH 2.3.2
is not affected either.

----------------------------------------------------------------------------

RESOLUTION

If you installed the OpenSSH 2.3.1 development snapshot, install the
latest snapshot.  Currently, the latest snapshot is OpenSSH 2.3.2 which
is available via http://www.openssh.com/.

----------------------------------------------------------------------------


--
Want to unsubscribe from this list?
Check out: http://cygwin.com/ml/#unsubscribe-simple