OpenSSH Vulnerability Found

A vulnerability has been discovered in a popular, free implementation of the Secure Shell protocols, prompting a warning from the suites developers, who are rushing to prepare a fix.

The vulnerability, which concerns local- and remote-root compromise, surfaced yesterday in OpenSSH, the free set of network connectivity tools developed by the OpenBSD Project. OpenSSH is frequently used in place of telnet, rlogin and ftp access and comes bundled with OpenBSD and a number of other open-source operating systems.

The vulnerability disclosure, posted Tuesday on the front page of the OpenSSH Web site, comes just days after the release of the latest version of the SSH package. According to the warning, users “are strongly encouraged to upgrade immediately to OpenSSH 3.3 with the UsePrivilegeSeparation option enabled. Privilege Separation blocks this problem. Keep an eye out for the upcoming OpenSSH 3.4 release on Monday [July 1] that fixes the vulnerability itself.”

According to developer Theo de Raadt, founder of the OpenBSD and OpenSSH projects, “No one knows about this hole yet.”

“We believe we have the information contained. It is after all in 27,000 lines of code,” said de Raadt. “If it does leak out, or a parallel discovery of it happens, we will be ready with an immediate patch.”

Even before the latest vulnerability was disclosed, OpenSSH developers have consistently suggested that users employ the tools privilege separation feature. The feature safeguards against any corruption in the sshd, which could lead to root compromise, according to OpenSSH developers.

OpenSSH encrypts all traffic, including passwords, to thwart eavesdropping, connection hijacking, and other network-level attacks, according to developers. Additionally, OpenSSH provides secure tunneling capabilities and a variety of authentication methods.

In addition to OpenBSD and FreeBSD, Open SSH works with dozens of operating systems including most flavors of Linux; NetBSD; Computone; Stallion; MacOS X Version 10.1; HP Procurve Switch 4108GL and 2524/2512; and IBM AIX.