-----BEGIN PGP SIGNED MESSAGE----- There's a new vulnerabiltiy in the OpenSSH daemon. The OpenSSH/OpenBSD team does not release any details concerning this issue, except: - This bug still exists in the most recent version, 3.3 - They are asking all users to upgrade to version 3.3 (sic), and enable the PrivilegeSeparation option. Setting PrivilegeSeparation to on causes large portions of the daemon to run in a so-called "chroot jail", i.e. in a very restricted environment. An attacker breaking this part of the SSH daemon will *not* obtain full root privilege (as he would if sshd runs without this option), but will find himself in an empty directory, inside a process running as a non privileged user (he can still do some harm this way, but it's a far cry from full root powers, of course). In a posting to bugtraq, Theo de Raadt says that using privilege separation, this new vulnerability cannot be exploited. The SuSE security team is working on creating OpenSSH updates with privilege separation enabled, and testing this functionality. We will release updated RPMs on FTP as they become available. In the meanwhile, we suggest that - if you do not need external access to your SSH daemons, turn off the SSH service on these machine completely, or block external access at the firewall. - if you do need extern access to your SSH daemons, make sure you restrict the hosts that it will talk to by setting appropriate firewall rules. If, for some reason, you cannot configure your firewall to block external SSH access, you can also restrict access through /etc/hosts.allow; the following will allow connections from hosts with IP addresses 1.2.3.4 and 5.6.7.8 while disallowing any other connections. sshd : 1.2.3.4 : allow sshd : 5.6.7.8 : allow sshd : ALL : deny It is not clear however whether this is really effective because we do not know anything about the vulnerability at all. Olaf Kirch -----BEGIN PGP SIGNATURE----- Version: 2.6.3in Charset: noconv iQEVAwUBPRgpi3ey5gA9JdPZAQFOfgf9Gzfs7N++Q8DkbAiEc2cbvUwKZjuS7yr/ GEaR3yRtBs/dyDVUB+EgEWgwwSDTwm4t6n0YfoyrnFdn5BZy+hDkFphJHabU7Vg8 39eN26AvvIgE0BxEg+Fq5kNYAApB+hvw/PLtQFFqSB3HHNfx227v03gzrC5xPuXN DFE9BMf4rTHj+YykkoLFt9rS6tPE3l0hm7ZUz0MfGNxIqcjw6TP8L7LF1LxepSlN QG0y//WoQafdbj9xY9ShbhdjloRMXg9XMMObcArNijASig4yw0sQ09clGPKtaYSA qX53NV29hrcfAYyH5Ejgfa4X/8UEG/onCnR7qUdZP26x0oZLRiRPpw== =IuTG -----END PGP SIGNATURE-----