Update your OpenSSH server. NOW.

lukast__ · July 1

OpenSSH has a RCE vulnerability (https://www.openssh.com/releasenotes.html):

A critical vulnerability in sshd(8) was present in Portable OpenSSH versions between 8.5p1 and 9.7p1 (inclusive) that may allow arbitrary code execution with root privileges. Successful exploitation has been demonstrated on 32-bit Linux/glibc systems with ASLR. Under lab conditions, the attack requires on average 6-8 hours of continuous connections up to the maximum the server will accept. Exploitation on 64-bit systems is believed to be possible but has not been demonstrated at this time. It's likely that these attacks will be improved upon.

Detailed info: https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
Debian stable already has a patched version (1:9.2p1-2+deb12u3).
(Yes, this was already posted on the OGF, but maybe not everyone noticed it.)

yoursunny · July 1

Life is too short to upgrade OpenSSH.

DataRecovery · July 2

More info (probably) can be found here, but the week is too busy, so I didn't manage to have even a briefest look into all this:

https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
https://www.openssh.com/txt/release-9.8
https://marc.info/?l=oss-security&m=171982317624594&w=2 - minimal patches for those who can't/don't want to upgrade

root · July 2

Last night I worked on upgrading all my servers. Damn you hackers!

Neoon · July 2

Apparently it takes hours to exploit this on 32bit machines, tested with 10ms jitter.
Roughly 10k retries until successful exploitation.

On 64bit, apparently a week.
But my guess, the more unstable the network is, the further away the target is, the more retries you have to do.

Unlikely that random machines are getting exploited, more like targeted attacks.
Still patch it though.

bliss · July 2

I've set up a whitelist in firewall, so is my VPS vulnerable if I don't update OpenSSH immediately?

AuroraZero · July 2

@bliss said:
I've set up a whitelist in firewall, so is my VPS vulnerable if I don't update OpenSSH immediately?

From a security stance still update

teamacc · July 2

@Neoon said:
Apparently it takes hours to exploit this on 32bit machines, tested with 10ms jitter.
Roughly 10k retries until successful exploitation.

On 64bit, apparently a week.
But my guess, the more unstable the network is, the further away the target is, the more retries you have to do.

Unlikely that random machines are getting exploited, more like targeted attacks.
Still patch it though.

If you know what dc your target is in, you could get a box in there as well and minimize jitter, right? That should cut down on the amount of attempts to make drastically.

Neoon · July 2

@teamacc said:

@Neoon said:
Apparently it takes hours to exploit this on 32bit machines, tested with 10ms jitter.
Roughly 10k retries until successful exploitation.

On 64bit, apparently a week.
But my guess, the more unstable the network is, the further away the target is, the more retries you have to do.

Unlikely that random machines are getting exploited, more like targeted attacks.
Still patch it though.

If you know what dc your target is in, you could get a box in there as well and minimize jitter, right? That should cut down on the amount of attempts to make drastically.

The more oversold the Node is, the harder it should be too.
All the CPU Steal the sshd deamon is hit with, good luck your your timing attacks bro.

teamacc · July 2

@Neoon said:

@teamacc said:

@Neoon said:
Apparently it takes hours to exploit this on 32bit machines, tested with 10ms jitter.
Roughly 10k retries until successful exploitation.

On 64bit, apparently a week.
But my guess, the more unstable the network is, the further away the target is, the more retries you have to do.

Unlikely that random machines are getting exploited, more like targeted attacks.
Still patch it though.

If you know what dc your target is in, you could get a box in there as well and minimize jitter, right? That should cut down on the amount of attempts to make drastically.

The more oversold the Node is, the harder it should be too.
All the CPU Steal the sshd deamon is hit with, good luck your your timing attacks bro.

I've never felt as safe as with my @c1vhosting vps.

Neoon · July 2

@teamacc said:

@Neoon said:

@teamacc said:

@Neoon said:
Apparently it takes hours to exploit this on 32bit machines, tested with 10ms jitter.
Roughly 10k retries until successful exploitation.

On 64bit, apparently a week.
But my guess, the more unstable the network is, the further away the target is, the more retries you have to do.

Unlikely that random machines are getting exploited, more like targeted attacks.
Still patch it though.

If you know what dc your target is in, you could get a box in there as well and minimize jitter, right? That should cut down on the amount of attempts to make drastically.

The more oversold the Node is, the harder it should be too.
All the CPU Steal the sshd deamon is hit with, good luck your your timing attacks bro.

I've never felt as safe as with my @c1vhosting vps.

The more downtime you have, the safer it should be to.
Premium @VirMach

MikeA · July 2

@bliss said:
I've set up a whitelist in firewall, so is my VPS vulnerable if I don't update OpenSSH immediately?

Why wouldn't you though? All it takes is an apt/dnf upgrade openssh

skorous · July 2

@MikeA said:

@bliss said:
I've set up a whitelist in firewall, so is my VPS vulnerable if I don't update OpenSSH immediately?

Why wouldn't you though? All it takes is an apt/dnf upgrade openssh

Plot twist: They're running Gentoo.

aRNoLD · July 4

I'm running on Debian Buster.

Mumbly · July 4

@aRNoLD said:
I'm running on Debian Buster.

Excellent, @aRNoLD, excellent. That's the only thing that has bothered me for years. What version of Debian does Arnold run?
Now that I know, I can die peacefully.

Not so soon!

Otus9051 · July 5

@yoursunny said:
Life is too short to upgrade OpenSSH.

Just use Dropbear

somik · July 8

You guys never have any good news...

Janevski · July 9

@Neoon said:

@teamacc said:

@Neoon said:

@teamacc said:

@Neoon said:
Apparently it takes hours to exploit this on 32bit machines, tested with 10ms jitter.
Roughly 10k retries until successful exploitation.

On 64bit, apparently a week.
But my guess, the more unstable the network is, the further away the target is, the more retries you have to do.

Unlikely that random machines are getting exploited, more like targeted attacks.
Still patch it though.

If you know what dc your target is in, you could get a box in there as well and minimize jitter, right? That should cut down on the amount of attempts to make drastically.

The more oversold the Node is, the harder it should be too.
All the CPU Steal the sshd deamon is hit with, good luck your your timing attacks bro.

I've never felt as safe as with my @c1vhosting vps.

The more downtime you have, the safer it should be to.
Premium @VirMach

That's a very interesting theory!
The more the downtime, the safer the server.
Cold servers, operated only when they're needed. If any.
Plus it reduces mean time befrore failure and cuts down on energy bill.

Update your OpenSSH server. NOW.

Comments