Date: Sun, 1 Jan 2012 16:53:09 +0100 From: Nico Golde <nion@...ian.org> To: oss-security@...ts.openwall.com Subject: speaking of DoS, openssh and dropbear (CVE-2006-1206) Hi, given the hash DoS I remembered a small program I wrote some time last year to demonstrate why the default configuration of openssh sucks (MaxStartups and LoginGraceTime). I attached the program. So now I'm wondering about two issues. I just tested this with dropbear 0.52 and I am still able to DoS it just fine even though at least http://www.securityfocus.com/bid/17024 claims that this has been fixed in Dropbear SSH Server 0.48. The other thing is that I'm wondering how to properly handle this issue with openssh? This certainly is no vulnerability that is straight-forward to fix and it might even be that openssh would argue that this is a problem. This is certainly a very easy DoS and given that this definitely affects Debian configurations and also the default configuration, I feel uncomfortable to further ignore this problem. I think its time to discuss this and work on a fix. Solar Designer is proposing something along the lines of per-source limits which seems like a reasonable solution to me (I guess he will send more information on this). What do you (especially the people shipping openssh) think about this? Kind regards Nico -- Nico Golde - http://www.ngolde.de - nion@...ber.ccc.de - GPG: 0xA0A0AAAA For security reasons, all text in this mail is double-rot13 encrypted. View attachment "sockext.c" of type "text/x-csrc" (3789 bytes) Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.