SSH vulnerability -- patch now!

[tugrik]

As reality_fox just found out the hard way, there's a new SSH exploit in the wild. It affects Debian, Gentoo, RedHat and OpenBSD systems (or anything using OpenSSH prior to v3.7). You should close your SSH ports immediately and then go get and apply the SSH patches going online now. I'm doing that at my office in the background while submitting this LJ entry.

Slashdot has more info on the specific bits. Here's a quick cut-paste for redhat users:

1.- Download the file openssh-3.7p1-1.src.rpm from any of the mirrors. For example:
ftp://ftp.easynet.be/openssh/portable/rpm/SRPMS/op enssh-3.7p1-1.src.rpm

2.- Build an .rpm for your RedHat Linux version:

# rpm --rebuild openssh-3.7p1-1.src.rpm

3.- Upgrade your OpenSSH packages:

# rpm -Fvh /usr/src/redhat/RPMS/i386/openssh-*.rpm

4.- Re-start your sshd daemon:

service sshd restart


This is a serious security hole. Many machines are being owned. Good luck on getting through to RedHat to get the 3.7 upgrade... just keep trying!

Comments

[koogrr.livejournal.com]

So... ah, how does this affect PuTTY, and Win2000 and my website I hardly ever do anything with on your machine? What do I need to do.

[smackjackal.livejournal.com]

1) Shouldn't affect putty.
2) Shouldn't affect Win2K unless you're running a version of the OpenSSH server on your Win2K box.
3) Shouldn't affect your website since Tugrik and Revar are on top of it.
4) You shouldn't have to do anything.

[tugrik.livejournal.com]

Thank you. :) I was about to reply in the same fashion.

The war at work goes well. We firewalled everything (a few SSH ports were opened through a few firewalls here and there) and are patching like mad. All done now, I think.

[kairee.livejournal.com]

Thanks for the pointer and warning. I've gotten all my systems (including the one at your place) updated. I hadn't realized this vulnerability was out there, before reading this.

[growlcoon.livejournal.com]

Wow...good to know. Thanks Tug!

[zeeth_kyrah]

It's things like this which are why the first day of getting my new Linux machine online is going to be spent updating everything I can think of (and a few things I didn't).