The CERT Coordination Center at Carnegie Mellon University in Pittsburgh is warning users about a serious security vulnerability in the OpenSSH (Secure Shell) that could enable a remote attacker to run malicious code or launch a denial-of-service attack against machines running the popular suite of secure network connectivity tools. Many of the leading Unix and Linux operating systems ship with OpenSSH and are vulnerable to attack. In addition, an unknown number of hardware devices, including network routers and switches, use the popular package and will need to be patched, according to Dan Ingevaldson, engineering manager of the X-Force security group at Internet Security Systems Inc. (ISS).
OpenSSH is a common tool used by network administrators to remotely communicate with hardware devices, replacing earlier communications tools like Telnet and rlogin (remote log-in) that sent communications back and forth in an unencrypted form. The exploitable flaw, which is in the buffer management function of OpenSSH software prior to Version 3.7, could make it possible for remote attackers to cause a buffer overflow on vulnerable machines, according to a CERT advisory. Attackers would need to modify certain OpenSSH parameters and send extra-large SSH data packets, perhaps larger than 10MB, to vulnerable machines to create the buffer overflow, Ingevaldson said. ISS recently discovered the problem itself and was researching it internally, he said.
News source: Computer World
