Blaze to Linux@programming.dev · 6 months ago'Critical' vulnerability in OpenSSH uncovered, affects almost all Linux systemswww.computing.co.ukexternal-linkmessage-square39fedilinkarrow-up1249arrow-down13cross-posted to: [email protected]
arrow-up1246arrow-down1external-link'Critical' vulnerability in OpenSSH uncovered, affects almost all Linux systemswww.computing.co.ukBlaze to Linux@programming.dev · 6 months agomessage-square39fedilinkcross-posted to: [email protected]
minus-squarelurklurk@lemmy.worldlinkfedilinkarrow-up28arrow-down1·6 months agothe in depth technical details TL;DR; sigalarm handler calls syslog which isn’t safe to call from a signal handler context. Their example exploit needed about 10k attempts to get a remote shell so it’s not fast or quiet, but a neat find regardless
minus-squarebitfucker@programming.devlinkfedilinkarrow-up5·6 months agoI can already imagine the log generated will be a hint. We usually automate those anyway as it is closer to (D)DoS too.
the in depth technical details
TL;DR; sigalarm handler calls syslog which isn’t safe to call from a signal handler context.
Their example exploit needed about 10k attempts to get a remote shell so it’s not fast or quiet, but a neat find regardless
I can already imagine the log generated will be a hint. We usually automate those anyway as it is closer to (D)DoS too.