Hacker News Reader

Comment by aborsy | Hacker News Reader

Has OpenSSH ever had a vulnerability that has led to unauthorized login access?

That would be a huge problem.

I don’t care about DoS or crashes!

Another example - where OpenSSH itself was not to blame, but rather PAM - was the old https://www.debian.org/security/2002/dsa-177

Where locked accounts were treated as password-less accounts, and would allow direct ssh access.

In Debian's defence, this was caught in the unstable distro and never made it out to a stable release.

> I don’t care about DoS or crashes!

Be very, very concerned with any vulnerabilities that cause crashes. Someone may discover a way to control where the process points to, and now you have a way more serious issue.

For else old folks it would be like WinNuke. Back in the day of dial up your entire PC was front and center on the internet. Windows 95 had a vulnerability that anyone could BSOD you. When it came out basically any IRC or multiplayer interaction you could get BSOD’d by any rando on the internet. I would be lying if I wasn’t occasionally on the sending end of these at the ripe old age of 12.

It could get much worse than a BSOD. Also from this era:

http://bash.org/?117002

How else would trinity hack the power plant in the matrix!

Yup CVE-2001-0144

https://nvd.nist.gov/vuln/detail/CVE-2001-0144

https://www.youtube.com/watch?app=desktop&v=0PxTAn4g20U

I remember people started probing pretty quickly, too, which was a good warning that you couldn’t be complacent about things like that. If memory serves, we’d upgraded most of our servers to only support SSH-2 before this happened and since that included our public shell servers (.edu) nobody broke in to anything but we did have to badger some proprietary vendors for updates to devices which were fortunately on our restricted internal-only network.

When that first showed in theaters in the bay area, people cheered and clapped when she was using Nmap and SSH Nuke. Non tech folks were probably a little confused.

There were dozens of us, dozens!

It was a relatively recent exploit, I remember being at an RSA conference when the remote ssh exploit was announced and everyone’s pager started going off and people hustled out of there. Fun times!

It's on their site too xD https://nmap.org/movies/

Per http://www.openbsd.org, “Only two remote holes in the default install, in a heck of a long time!” I believe, at least one of these, was SSH related.

They switched to "heck of a long time" because they had that blurb of text since the 90s. So we're talking about 2 holes in about 25 years.

Though I think I heard some criticism of what counts and what does not for that tally, maybe 20 years ago.

The project was fairly innovative of including now-standard practices like having the daemon drop its privileges.

Iirc the criticism was that the default install has no services enabled basically.

Yeah, people in the 90s really loved installing redhat 4 (not rhel 4, the old versions) and getting a vulnerable pop2/pop3/imapd running by default after installs. You would get hacked within the hour if not behind firewalls.

Very unfair of OpenBSD (and other security conscious OSes) to not compete on equal terms there.

Yes. https://en.m.wikipedia.org/wiki/OpenBSD#Security_record

Team TESO wrote an excellent exploit back in the day - one of the best groups of the early 2000s.

in certain cases crashes can be used to gain login access

Reply on news.ycombinator.com