2.3.1 security note.

Author: provos

advisories/ssh_bypass.txt

@@ -0,0 +1,41 @@
+----------------------------------------------------------------------------
+                
+                        OpenBSD Security Advisory
+        
+                            February 8, 2001
+
+             Authentication By-Pass Vulnerability in OpenSSH-2.3.1
+
+----------------------------------------------------------------------------
+
+SYNOPSIS
+
+OpenSSH-2.3.1, a development snapshot, only checked if a public key
+for public key authentication was permitted.  In the protocol 2 part
+of the server, the challenge-response step that ensures that the
+connecting client is in possession of the corresponding private key
+has been omitted. As a result, anyone who could obtain the public key
+listed in the users authorized_keys file could log in as that user
+without authentication.
+
+A fix for this problem was committed on Februrary 8th.  The problem
+was introduced on January 18th.  This is a three week time window.
+
+----------------------------------------------------------------------------
+
+AFFECTED SYSTEMS
+
+This vulnerability affects only OpenSSH version 2.3.1 with support for
+protocol 2 enabled.  The latest official release OpenSSH 2.3.0 is not
+affected by this problem.  The latest snapshot version OpenSSH 2.3.2
+is not affected either.
+
+----------------------------------------------------------------------------
+
+RESOLUTION
+
+If you installed the OpenSSH 2.3.1 development snapshot, install the
+latest snapshot.  Currently, the latest snapshot is OpenSSH 2.3.2 which
+is available via http://www.openssh.com/.
+
+----------------------------------------------------------------------------

openssh/security.html

@@ -77,13 +77,23 @@ <h2><font color=#e00000>Security</font><hr></h2>
     lead to remote root access.  This problem has been fixed in
     OpenSSH 2.3.0.  However, versions prior to 2.3.0 are vulnerable.
 
+</dl>
+<p>
+<li>OpenSSH 2.3.1, a development snapshot, is vulnerable to
+    "Feb 8, 2001: Authentication By-Pass Vulnerability in OpenSSH-2.3.1",
+    <a href="http://www.openbsd.org/advisories/ssh_bypass.txt">OpenBSD Security Advisory</a>.  
+    In protocol 2, authentication could be bypassed if public key
+    authentication was permitted. This problem does exist only
+    in OpenSSH 2.3.1.  OpenSSH 2.3.0 and versions newer than 2.3.1
+    are not vulnerable to this problem.
+
 </dl>
 
 <hr>
 <a href=index.html><img height=24 width=24 src=back.gif border=0 alt=OpenSSH></a>
 <a href=mailto:[email protected]>[email protected]</a>
 <br>
-<small>$OpenBSD: security.html,v 1.10 2001/02/08 23:49:04 provos Exp $</small>
+<small>$OpenBSD: security.html,v 1.11 2001/02/09 04:24:03 provos Exp $</small>
 
 </body>
 </html>