漏洞信息详情
SSH1 SSH守护进程登录失败漏洞
- CNNVD编号：CNNVD-200106-166
- 危害等级： 高危
- CVE编号：
CVE-2001-0471
- 漏洞类型：
设计错误
- 发布时间：
2001-06-27
- 威胁类型：
远程
- 更新时间：
2006-09-05
- 厂 商：
ssh
- 漏洞来源：
in a Crimelabs Security Note on February 5, 2001.');">This vulnerability...
-
漏洞简介
SSH守护进程1 (也称为SSHD-1或者SSH-1) 1.2.30及其早期版本不记录重复登录尝试。远程攻击者借助强力攻击危害没有侦察到的账户。
漏洞公告
Patch supplied by Jose Nazario :
--- ssh-1.2.30/sshd.c.orig Wed Jan 31 12:11:08 2001
+++ ssh-1.2.30/sshd.c Wed Jan 31 12:57:36 2001
@@ -2408,7 +2408,7 @@
remote_user_name = client_user;
break;
}
- debug("Rhosts authentication failed for '%.100s', remote '%.100s', host '%.200s'.",
+ log_msg("Rhosts authentication failed for '%.100s', remote '%.100s', host '%.200s'.",
user, client_user, get_canonical_hostname());
xfree(client_user);
break;
@@ -2469,7 +2469,7 @@
mpz_clear(&client_host_key_n);
break;
}
- debug("RhostsRSA authentication failed for '%.100s', remote '%.100s', host '%.200s'.",
+ log_msg("RhostsRSA authentication failed for '%.100s', remote '%.100s', host '%.200s'.",
user, client_user, get_canonical_hostname());
xfree(client_user);
mpz_clear(&client_host_key_e);
@@ -2500,7 +2500,7 @@
break;
}
mpz_clear(&n);
- debug("RSA authentication for %.100s failed.", user);
+ log_msg("RSA authentication for %.100s failed.", user);
}
break;
@@ -2633,7 +2633,7 @@
authenticated = 1;
break;
} else {
- debug("TIS authentication for %.100s failed",user);
+ log_msg("TIS authentication for %.100s failed",user);
memset(password, 0, strlen(password));
xfree(password);
break;
@@ -2672,7 +2672,7 @@
if (password_attempts > 0)
{
/* Log failures if attempted more than once. */
- debug("Password authentication failed for user %.100s from %.100s.",
+ log_msg("Password authentication failed for user %.100s from %.100s.",
user, get_canonical_hostname());
}
password_attempts++;
@@ -2693,7 +2693,7 @@
authenticated = 1;
break;
}
- debug("Password authentication for %.100s failed.", user);
+ log_msg("Password authentication for %.100s failed.", user);
memset(password, 0, strlen(password));
xfree(password);
break;
SSH Communications Security SSH 1.2.30
-
SSH Communications ssh 1.2.31.tar.gz
ftp://ftp.ssh.com/pub/ssh/ssh-1.2.31.tar.gz
参考网址
来源: BID
名称: 2345
链接:http://www.securityfocus.com/bid/2345
来源: BUGTRAQ
名称: 20010205 SSHD-1 Logging Vulnerability
链接:http://www.securityfocus.com/archive/1/160648
受影响实体
补丁
评论