Portable OpenSSH Security Advisory: sshpam.adv

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

This document can be found at:  http://www.openssh.com/txt/sshpam.adv

1. Versions affected:

        Portable OpenSSH versions 3.7p1 and 3.7.1p1 contain multiple
        vulnerabilities in the new PAM code. At least one of these bugs
        is remotely exploitable (under a non-standard configuration,
        with privsep disabled).

        The OpenBSD releases of OpenSSH do not contain this code and
        are not vulnerable. Older versions of portable OpenSSH are not

2. Solution:

        Upgrade to Portable OpenSSH 3.7.1p2 or disable PAM
        support ("UsePam no" in sshd_config).

        Due to complexity, inconsistencies in the specification and
        differences between vendors' PAM implementations we recommend
        that PAM be left disabled in sshd_config unless there is a need
        for its use. Sites only using public key or simple password
        authentication usually have little need to enable PAM support.

Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

Site Timeline