Re: [LUG] ISS Advisory: OpenSSH Remote Challenge Vulnerability

[Simon Waters <Simon@xxxxxxxxxxxxxxxxxxxx>]

Adrian Midgley wrote:
> SuSE report that their version does not have the relevant (holey)
> authentication method compiled in as standard, so OK for this one.  Good.
>
> Anyone know about SUN Cobalt Raq Linux yet?

I think the HP-UX advisory sums it up nicely, "disable
challengeResponse, disable KeyboardIntAuth, and await 3.4" sums
up the approach nicely, now if they had said that at first Zozo
could have got more sleep this week, he always sounds like he
needs more.

Oh and a mod_ssl bug in Apache made it to BugTraq - only
relevant to people who share Apache instances between clients if
I read it right - it never rains but it pours.

Perhaps Theo will give me a job patching things.

--
The Mailing List for the Devon & Cornwall LUG
Mail majordomo@xxxxxxxxxxxx with "unsubscribe list" in the
message body to unsubscribe.