OpenSSH rumors (possible remote exploit)

[x3roconf]

Over the past 24 hours we've had a number of readers tell us that there is an OpenSSH exploit in active use. We cannot confirm its existence, other than a DOS exploit for OpenSSH that is on Milw0rm. If you have any concrete evidence of this (not rumors or URLs to blogs where people are discussing that there might be a problem) please let us know via our contact form. Again, no rumors and no links to discussions of rumors please. We need reports of active exploitation or other evidence that this a real issue.

UPDATE 1: One reader sent us a URL to a site showing the active exploitation of a vulnerable system that looks like it was recorded last Friday. So far this is the only "evidence" of an attack. It is against an older version of OpenSSH so if this is the source of the rumor, then it is NOT a problem with the most updated version. Without giving away everything (Google is your friend if you want to find the original), here is a snip from the log:

anti-sec:~/pwn# cd xpl/

anti-sec:~/pwn/xpl# ./0pen0wn -h xx.yy.143.133 -p 22

[+] 0wn0wn – anti-sec group
[+] Target: xx.yy.143.133
[+] SSH Port: 22

[~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~>]

sh-3.2# export HISTFILE=/dev/null

sh-3.2# id
uid=0(root) gid=0(root)
groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(di sk),10(wheel)

sh-3.2# uname -a
Linux xx.yy.net 2.6.24.5-grsec-hostnoc-4.0.0-x86_64-libata
#1 SMP Mon Aug 25 15:56:12 EDT 2008 x86_64 x86_64 x86_64 GNU/Linux

sh-3.2# head -n1 /etc/shadow
root:$1$t4e0hufX$UH4Q5jTj93EEAODNrSaWO/:14412:0:99999:7:::

sh-3.2# w
03:43:43 up 7 days, 54 min, 1 user, load average: 9.01, 9.78,
10.73
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
root pts/0 125.238.144.224 20:17 7:26m 13:18 13:18 htop

sh-3.2# pwd
/root


Source: http://isc.sans.org/diary.html?storyid=6742

[munky99999]

I was just reading this; and came because I thought I'd read a thread with someone's ssh being compromised.

[wirelessmonkey]

So far, there is no indication of an exploit for current, up to date, versions of openssh. Cross your fingers, and update your boxen.

[osjak]

What is considered the up-to-date openssh server? I have Ubuntu 8.10 LTS server and this is what's installed:
SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu1.2
while the OpenSSH website hosts 5.2 version. So is my SSH server vulnerable or not?

[xanda]

it is rumors :) maybe you can see some "exploit" in the Net but it is FAKE. Take a look at here this entry http://blog.xanda.org/?p=851

[jerome1232]

What is considered the up-to-date openssh server? I have Ubuntu 8.10 LTS server and this is what's installed:
SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu1.2
while the OpenSSH website hosts 5.2 version. So is my SSH server vulnerable or not?

While you may not have the most up to date version of ssh, Ubuntu patches in security updates so no, your ssh server is not vulnerable.

[The Tronyx]

The exploit is/was fake. Their SSH did get hacked however, it was not due to some 0day. The hype over the alleged 0day is largely due to a...misinterpretation of results.


./0pen0wn


That script is nothing more than a tool to bruteforce SSH.