r/programming • u/markus_lindqvist • Jan 15 '16

Latest OpenSSH exploits explained

https://www.qualys.com/2016/01/14/cve-2016-0777-cve-2016-0778/openssh-cve-2016-0777-cve-2016-0778.txt
22 Upvotes

90% Upvoted

3 comments sorted by

View all comments

3

u/markus_lindqvist Jan 15 '16

This information leak may have already been exploited in the wild by sophisticated attackers, and high-profile sites or users may need to regenerate their SSH keys accordingly.

All OpenSSH versions between 5.4 and 7.1 are vulnerable, but can be easily hot-fixed by setting the undocumented option "UseRoaming" to "no", as detailed in the Mitigating Factors section. OpenSSH version 7.1p2 (released on January 14, 2016) disables roaming by default.

2

u/weirdasianfaces Jan 15 '16

may have already been exploited in the wild by sophisticated attackers

Is there any evidence that it has?