mailing list archives
Re: [Rumor] SSH 0-day
From: "frank^2" <frank2 () dc949 org>
Date: Wed, 8 Jul 2009 16:09:31 -0700
On Wed, Jul 8, 2009 at 1:58 PM, Anderson Kaiser<alpkaiser () gmail com> wrote:
2009/7/8 Martin Spinassi <martins.listz () gmail com>:
I've been reading around (openssh mailing list, some forums, etc.) a
rumor about a 0-day exploit in openssh. Does anybody knows if there is
*really* something like this in the wild?
This attack sounds more like a brute-force attack than a 0-day. You
can see it in the original post.
There's also the ominous anonymous comment left by a fellow on a blog:
The significant stuff: "Expect the SSH exploit to be made public
before BH/DC. I have proof that I can't share (sorry), that this
exploit does exist, does not work against current versions of SSH, and
is actively being used by members of the anti-sec movement."
Signs seem to be pointing to hoax, old exploit or non-exploit, though.
Unfortunately there's really not quite enough information to make an
assessment yet, IMHO.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
Re: [Rumor] SSH 0-day Digital Jihad (Jul 10)