Trivial authentication bypass in libssh leaves servers wide open

Re:Trivial authentication bypass in libssh leaves servers wi... by Sir_Cmpwn on Wednesday October 17, 2018 @04:50PM (#18243690)

Note that libssh != openssh, which is what's probably running on your server.

[ Parent | on HN ]

Re:Trivial authentication bypass in libssh leaves servers wi... by the_clarence on Thursday October 18, 2018 @07:19AM (#18247379)

I had a semi heartattack for a second until I realized that

[ Parent | on HN ]

Re:Trivial authentication bypass in libssh leaves servers wi... by stephenr on Wednesday October 17, 2018 @05:10PM (#18243843)

I tried to find what it is used in. The site claims that it's used server-side by GitHub: https://www.libssh.org/#text-5

[ Parent | on HN ]

Re:Trivial authentication bypass in libssh leaves servers wi... by throwaway2048 on Wednesday October 17, 2018 @06:12PM (#18244299)

    $ apt-cache rdepends libssh-4
    libssh-4
    Reverse Depends:
      libpam-x2go
      yafc
      x2goclient
      tmate
      remmina-plugin-nx
      remmina
      openvas-nasl
      libopenvas9
      libssh-dev
      cockpit-bridge
      kio-extras
      hydra

This is all of the packages that depend on libssh in Debian Testing, doesn't seem to be very problematic, I've only heard of one thing on this list, and that doesn't use the server code anyways.

[ Parent | on HN ]

Re:Trivial authentication bypass in libssh leaves servers wi... by tyingq on Wednesday October 17, 2018 @10:37PM (#18245498)

Tmate might have issues...there's both client and server code.

[ Parent | on HN ]

Re:Trivial authentication bypass in libssh leaves servers wi... by NVRM on Thursday October 18, 2018 @08:11AM (#18247582)

Nice command. Cockpit-bridge has a very good name!

[ Parent | on HN ]

Re:Trivial authentication bypass in libssh leaves servers wi... by torstenvl on Wednesday October 17, 2018 @05:15PM (#18243877)

GitHub says that the way they're using libssh isn't affected. They apparently use in-house code for the authentication.

https://twitter.com/GitHubSecurity/status/105231733337972326...

[ Parent | on HN ]

Re:Trivial authentication bypass in libssh leaves servers wi... by pronoiac on Wednesday October 17, 2018 @06:34PM (#18244420)

Dependents in Homebrew: Csync, Hydra, Sshtrix, Yafc.

[1] http://brewformulas.org/Libssh

[ Parent | on HN ]

Re:Trivial authentication bypass in libssh leaves servers wi... by makomk on Wednesday October 17, 2018 @08:41PM (#18245059)

Those are almost certainly all using the client functionality. I'm not sure what uses libssh as an ssh server. (Edit: it may be that there is no open source code in existence anywhere which uses libssh in this way, except maybe some sample code. See https://twitter.com/cryptomilk/status/1052286350379114496 )

[ Parent | on HN ]

Re:Trivial authentication bypass in libssh leaves servers wi... by chadcatlett on Wednesday October 17, 2018 @07:39PM (#18244770)

For some reason that site doesn't seem to list all possibly reverse dependencies of libssh.

According to the brew uses command the possible dependents are ffmpeg, [email protected], hydra, sshtrix, tmate, wireshark, and yafc. I say possible because some of those can optionally depend upon libssh, but the user has to opt-in to building with libssh support.

[ Parent | on HN ]