From DD, Erich Schubert:

http://blog.drinsama.de/erich

If any of you Security experts believe this overstates the danger, please say so. I'm no expert, but what he says sounds sane to me.

I'm not a security expert and I don't know if this was posted elsewhere but H.D. Moore explains the damage "better" for my tastes: http://metasploit.com/users/hdm/tools/debian-openssl/

I think what the author is try to get at is this bit here:

He makes it sound like anyone running OpenSSH is vuln, which isn't exactly true. On my systems, both my OpenSSL and OpenSSH are built by me and have been for years now, so I've not turned out any of the keys that are potentially knowable. Say I have a user, john, home is /home/john, and he is a Debian user. He made a SSH key, sent it to me (root), and I put it in /home/john/.ssh/authorized_keys. Now john can login to my system. We find out Debian's OpenSSL is hosed, and so john replaces all his stuff. I am safe, and so I let /home/john/.ssh/authorized_keys stand, not thinking about it. Now Mr. Evil Hacker has all those weak keys in his Weak-Debian-Key kit (bet one is released real soon, if not already!) He connects to my system, and starts running thru keys to the john account, which he would hit (if not for several other security measures in place on my system). Debian has a tool to find those keys, I think it's called dowkd.pl. When I run this on my user's .ssh directory, it does in fact flag key 3, but it gives an odd message about no blacklist suitable. I'm guessing it's telling me it is a weak key? Anyway, I know it to be potentially, because while "john" isn't the user's real name, there is such a real user here, and I know he uses Debian, and generated that key only about a year ago. The solution would be 'cat /dev/null > /home/john/.ssh/authorized_keys' and notify john to re-send a properly created key.

That's my take on this without viewing the metasploit link [1]

...that reported it




[1] I'm sorry, but I will not visit HDM's site, nor look at his work after his misguided attempt to filter Tor traffic by keyword on sniffed exit nodes. He has lost all credibility to me.

http://blog.vulnerableminds.com/2007...than-good.html

More info here:

http://isc.sans.org/diary.html?storyid=4421
http://isc.sans.org/diary.html?storyid=4420

Both entries are showing at http://isc.sans.org/diary.html at this moment in time, although that could change later today. Note that the threatcon is yellow.

With all due respect but your self-inflicted refusal to read that information harms nobody but you and leads to IMHO unnecessary rehashing. Regardless of how utterly misguided his attempts may have been, the TOR/HDM argument has no bearing on this subject unless you want to point out what he wrote is dead wrong (again). BMG, but then you would have to actually read the text, wouldn't you?..

Haha, have him upload it to your server via scp