| |||||||||||
The OpenSSH vulnerability and the disclosure processThe OpenSSH vulnerability and the disclosure processPosted Jul 4, 2002 8:24 UTC (Thu) by edmundo (guest, #616)In reply to: The OpenSSH vulnerability and the disclosure process by beejaybee Parent article: The OpenSSH vulnerability and the disclosure process
"withdrawing SSH would only encourage the deployment of other I'm not sure about that: telnet is vulnerable to packet sniffing, but By the way, there is at least one alternative implementation of sshd:
(Log in to post comments)
The OpenSSH vulnerability and the disclosure process Posted Jul 4, 2002 10:08 UTC (Thu) by beejaybee (guest, #1581) [Link] > I'm not sure about that: telnet is vulnerable to packet sniffing, butat least a bug-free telnetd is safe against worms and script kiddies. Umm. Telnet access to your host is vulnerable to keystroke trapping on any system used to access your host, as well as packet sniffing. Even if you only give away an unpriveleged username/password combo, ways may exist to exploit this directly or through privelege escalation due to bugs in unrelated programs. System compromise is a problem relevant to ssh/telnet/ftp style access; but worms aren't, since there is no direct way for them to propogate, unless the system has already been compromised. There seem to be a lot of systems around running versions of telnetd which are undoubtedly not bug-free; even those versions of telnetd which have no _known_ vulnerabilities are in any case probably just as insecure as ssh. I stand by my previous comment.
|
|||||||||||