, The Register 2002-12-19
Secure shell (SSH) protocol implementations from several vendors are subject to a number of potentially serious security flaws, security clearing house CERT warned earlier this week.
The flaws (such as they are) could allow a remote attacker to execute arbitrary code with the privileges of a particular SSH process or cause systems to crash. The vulnerabilities affect SSH clients and servers, and they occur before user authentication takes place.
The vulnerabilities, including ever-popular buffer overflow bugs, in several SSH implementations came to light after tests using a suite called SSHredder, from a firm called Rapid 7.
CERT advises affected users to apply appropriate patches or upgrade, as fixes become available. More generally, it advises access to SSH servers should be limited by firewalls and packet-filtering systems. ®
