Nasty regreSSHion bug in OpenSSH puts roughly 700K Linux boxes at risk

The Register ^ | 1 July 2024 | Connor Jones

[ShadowAce]

According to the OpenSSH team and its release notes for version 9.8, which includes the fix for CVE-2024-6387, in lab conditions it took between six and eight hours to beat the race condition.

[ShadowAce]

[algore]

OH SSHit

[Jamestown1630]

No matter how bad the news is, those little guys always make me happy.

[butterdezillion]

This was what my son was frantically trying to figure out last night when a tornado warning sent us into the basement. He’s worked so hard to set up our secure server and just like that he had to figure out how to keep it secure.

[ShadowAce]

Since I posted this a few minutes ago, I checked my available updates, and my distro already has the newest package ready to DL with the fix.

I love Open Source!

[Gene Eric]

Yet another reason to restrict network access to a sshd endpoint.

[Carriage Hill]

Ping...

[Dead Corpse]

Well..... That’s not good.

[dayglored]

> Since I posted this a few minutes ago, I checked my available updates, and my distro already has the newest package ready to DL with the fix. I love Open Source!

Yep! A simple "apt-get update && apt-get upgrade" did it for all my systems -- the fix was waiting for me.

[dayglored]

The Register tends to get a little breathless about vulns. This one is very difficult to exploit, but you have to read deep into the article to discover that. Oh well, they deserve the clicks...

[ShadowAce]

In my .bashrc:

alias update='apt update && sleep 2 && apt list --upgradable'

[zeugma]

Since I posted this a few minutes ago, I checked my available updates, and my distro already has the newest package ready to DL with the fix.

I just did an update and it looks like this is the latest fo Kubuntu: OpenSSH_9.6p1

[Bob434]

im running mint, but haven’t got any update recommended in the update app-= where woudl i go to find out if there is an update?

[ShadowAce]

I usually check from a terminal:

apt update -y && apt list --upgradable

[dayglored]

First, check your version of OpenSSH. At a terminal Bash prompt, run this command:

sshd --help

It will print out its OpenSSH version and some usage info (since --help is not a valid option). You should see a string like this:

OpenSSH_8.2p1 ....

That's the OpenSSH version. Check it against the ranges that are vulnerable. If yours is not vulnerable then you're okay. If your is potentially vulnerable, use a command like the one ShadowAce posted above in #12:

sudo apt update && sleep 2 && apt list --upgradable

[Bob434]

Thank you, I will do that tonight-

[Openurmind]

Thank you for the ping... :)

[ShadowAce]

Correction:

apt update -y && apt list --upgradable should be

apt update && apt list --upgradable

.

Get rid of the -y flag. It's not supported.

[Openurmind]

I got the same list with or without the -y flag. Ubuntu/mint...