New SSH exploit found in wild! Admins beware!

[com]

The attack makes an enormous amount of ssh connections and attempts various offsets until it finds one that works permitting root login.

I have received numerous messages from folks requesting anonymity or direct-off-list-reply confirming this exploit;

http://lists.netsys.com/pipermail/fu...ead.html#10103

[sweet7]

broken link

[NetRodent]

http://www.netsys.com/cgi-bin/displaynews?a=652

[skazzel]

I am going to bump this...this is a remote root exploit with no patch available at the moment. Probably 90% of us here run our sites on servers with SSH installed.

You should firewall off the ssh port so it is only available from ip addresses that you will need to access it from.

[NetRodent]

There is a patch for it now, and OpenSSH 3.7 (came out today) does not have this vulnerablity. Not all of the OpenSSH mirrors have updated yet though.

[extreme]

Red Hat linux patches are out ...

[rossiya2]

I don't use openssh DOH

It's like the 20th exploit for that program.

For the same 'hosting companies' that run named as superuser I guess.....

[ytcracker]

good looking out bump

ive been patching shit all morning

[JDog]

Hmm, our host is already on this and upgrading.

jDOG

[rossiya2]

Why do you guys patch when you should delete? Herd mentality?