Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In a discussion about the recent OpenSSL information disclosure vulnerability, the subject of OpenSSH being vulnerable came up. While OpenSSH is not vulnerable due to the problem lying in the TLS handshake, it opened discussion for the security of OpenSSH on FreeBSD.

Theo de Raadt had this to say:

... as long as you aren't using FreeBSD or a derivative (hint: Juniper), you are fine. That's the only place I know of an OpenSSH hole.

This coming from someone in his position is worrisome. I don't know if this is a stab at the FreeBSD project, or if he is privy to some inside exploit of the OpenSSH implementation on FreeBSD.

Since the person in question doesn't believe in public disclosure, I am wondering what steps people have taken to mitigate this possibly huge security flaw, if it exists at all.

share|improve this question
1  
There is likely something to his words, about ⅔ to ⅓. The proportions may have been blown up, but considering that FreeBSD is not like the other BSDs but split very early, and suffers from NIH a lot, there are lots of differences in the base system. I can believe that the OpenBSD/OpenSSH developers have analysed running it on FreeBSD and found some issue, and I readily believe there were communication difficulties between them, and I have vague ideas why he'd withhold it now. I have no idea what precisely they could have found. –  mirabilos Apr 13 at 9:59
    
I just wanted to update that I've done my work trying to hunt down the answer. I've not been able to get a response from Theo, though I've discussed it with many FreeBSD developers. No one seems to know of a vulnerability and best guesses say it might just be him pissed off at FreeBSD's default OpenSSH config. –  David Houde Apr 22 at 23:54

2 Answers 2

The Heartbleed bug was a SSL/TLS protocol implementation bug. OpenSSH does not use the SSL protocol in anyway (Although it does use some of the same cryptographic primitives).

So you don't need to worry about Heartbleed causing problems for OpenSSH.

share|improve this answer
    
This question was meant to discuss a possible OpenSSH vulnerability on FreeBSD. The topic came up in a discussion of whether OpenSSH was vulnerable to Heartbleed, but heartbleed is not the topic here. After re-reading the question, I decided to edit it because I can see how it is misleading. I appreciate you taking the time to respond. –  David Houde Apr 22 at 23:52

History has shown that Theo de Raadt is somewhat of an asshole. I wouldn't read too much into what he has to say. If you're concerned, check the version of OpenSSH on FreeBSD and the OpenSSH on OpenBSD, diff the two, and analyze the differences.

share|improve this answer
1  
Theo may be an arsehole, but his statements are normally technically sound. From my reading of his statement, there is a problem with the underlying operating system that makes running (unmodified) portable-OpenSSH on FreeBSD and derivates less secure. Disclaimer: I founded MirBSD because of… communication problems… with the OpenBSD people, but I still consider them technically good. (I do question and review stuff from them occasionally.) –  mirabilos Apr 13 at 9:56
    
If there is a flaw that makes OpenSSH less secure on FreeBSD and derivatives, hence a "hole", then I would argue that it's an OpenSSH problem not a FreeBSD problem. –  Scott Apr 14 at 12:44
    
Scott, feel free to argue however much you want, as you arguïng won’t change reality. If there is a problem in the underlying operating system, the situation is often that you either cannot work around it (it simply is not possible technically) or do not want to (as publishing a workaround would expose the security problem in the base OS, which may still be under embargo; or if there is not enough incentive for you to do so; or if it’s not worth the effort or introduces other problems). –  mirabilos Apr 14 at 16:09
    
It depends on the nature of the problem. If the problem is "FreeBSD doesn't implement ASLR by default", for example, then the problem is that there's a hole in OpenSSH that is mitigated by ASLR, not just that FreeBSD doesn't do the right thing. This is why I said to examine a diff of the source codes and see what has changed. If nothing is different, then what in OpenSSH is exploitable? –  Scott Apr 14 at 16:11
1  
Theo de Raadt did. Read the email. –  Scott Apr 18 at 14:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.