HPE Community
Operating System - HP-UX
1830366 Members
2482 Online
110001 Solutions
New Discussion

** Security Vulnerability in SSHd **

 
Michael Gretton
Frequent Advisor

‎07-25-2001 04:05 AM

‎07-25-2001 04:05 AM

** Security Vulnerability in SSHd **

I work for the Government and have heard about a security vulnerability in SSH if you are using password authentication. Accounts that are disabled can be exploited. I have been told to upgrade my SSH to 3.0.1. Has HP addressed this vulnerability? Is there a newer version of SSH for HP 10.20 and 11 out there? Or should I just buy it from SSH?

0 Kudos
Reply
2 REPLIES 2
paul courry
Honored Contributor

‎07-25-2001 05:35 AM

‎07-25-2001 05:35 AM

Re: ** Security Vulnerability in SSHd **

The following website has a good article on it:

http://www.theregister.co.uk/content/55/20594.html

Yes, HPUX *is* vulnerable, however, there is a workaround, go see the article.
0 Kudos
Reply
Chris Calabrese
Valued Contributor

‎07-25-2001 05:57 AM

‎07-25-2001 05:57 AM

Re: ** Security Vulnerability in SSHd **

Some background here...
1. HP doesn't ship ssh, so there's no reason to expect them to address this issue.
2. The problem affects both all products from SSH Communications and F-Secure starting with 2.0.
3. The problem does not affect OpenSSH or SSH 1.x.
Brainbench MVP for Unix Administration and Internet Security, SANS Review Editor, and Center for Internet Security HP-UX Benchmark project leader
0 Kudos
Reply
The opinions expressed above are the personal opinions of the authors, not of Hewlett Packard Enterprise. By using this site, you accept the Terms of Use and Rules of Participation.