topic Re: Is SSH 3.61..002 for HP-UX secure ? in Operating System - HP-UX

Is SSH 3.61..002 for HP-UX secure ?

GIRIJA SWAIN — Mon, 03 Nov 2003 01:05:07 GMT

Can any one let me know, if there is any security bug in this latest version of SSH 3.61.002 for HP-UX 11.11 ? I see Open SSH 3.7.1 is the latest and fixed a bug as latest as 19th Sept 2003. Is there any plan of HP to release a depot for 3.7.1 or is it safe to use 3.61.002 for now ?

Re: Is SSH 3.61..002 for HP-UX secure ?

Rajeev Shukla — Mon, 03 Nov 2003 01:17:22 GMT

I bet bugs are there in almost all applications and softwares, they are seen only when someone experiences or sees them.
And if HP hasn't released any newer version or there hasn't been any patch release for security vunerability i am sure you can use the existing version.
Trust HP!!!

Re: Is SSH 3.61..002 for HP-UX secure ?

Jerome Henry — Mon, 03 Nov 2003 01:51:09 GMT

Hi,

The bug was fixed in HP UX 3.6 version already. Look at this thread :

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=240230

RGDS

J

Re: Is SSH 3.61..002 for HP-UX secure ?

GIRIJA SWAIN — Mon, 03 Nov 2003 02:13:49 GMT

Thanks for all the reply so far. I am particularly interested to know if the buffer management bug has been fixed in HP's SSH-3.61.002. Open Forume has reported like this:- "OpenSSH 3.7.1 and newer are not vulnerable to "September 16, 2003: OpenSSH Buffer Management bug", OpenSSH Security Advisory and CERT Advisory CA-2003-24."

Re: Is SSH 3.61..002 for HP-UX secure ?

Stefan Farrelly — Mon, 03 Nov 2003 05:59:57 GMT

HP's SSH 3.61.002 does fix one recent buffer overlow bug but there has been another similar bug since. The problem is there is always going to be more bugs found - as soon as you install one version a new bug will be found and you are out of date again, and HP always take a bit more time to package the latest version of SSH into their own product so theyre always going to be 1 or 2 steps behind openssh.

The only way to keep uptodate is use openssh - but again, as soon as you get around to installing the latest version a new bug will be found. Its a no win situation.

Re: Is SSH 3.61..002 for HP-UX secure ?

Berlene Herren — Mon, 03 Nov 2003 08:18:51 GMT

Please see HPSBUX0309-282 security bulletin, or this post:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=224090

To date, following the instructions in the above bulletin, HP Secure Shell is safe for use.

Thanks,
Berlene

Re: Is SSH 3.61..002 for HP-UX secure ?

Mark Grant — Mon, 03 Nov 2003 08:30:07 GMT

Remember the old saying

"all sofware contains at least one bug and can be reduced by at least one instruction"

This means, of course, that all software can be reduced to one intruction that doesn't work.