Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In a discussion about the recent OpenSSL information disclosure vulnerability, the subject of OpenSSH being vulnerable came up.

Theo de Raadt had this to say:

... as long as you aren't using FreeBSD or a derivative (hint: Juniper), you are fine. That's the only place I know of an OpenSSH hole.

This coming from someone in his position is worrisome. I don't know if this is a stab at the FreeBSD project, or if he is privy to some inside exploit of the OpenSSH implementation on FreeBSD.

Since the person in question doesn't believe in public disclosure, I am wondering what steps people have taken to mitigate this possibly huge security flaw, if it exists at all.

share|improve this question
1  
There is likely something to his words, about ⅔ to ⅓. The proportions may have been blown up, but considering that FreeBSD is not like the other BSDs but split very early, and suffers from NIH a lot, there are lots of differences in the base system. I can believe that the OpenBSD/OpenSSH developers have analysed running it on FreeBSD and found some issue, and I readily believe there were communication difficulties between them, and I have vague ideas why he'd withhold it now. I have no idea what precisely they could have found. –  mirabilos Apr 13 at 9:59
add comment

1 Answer

History has shown that Theo de Raadt is somewhat of an asshole. I wouldn't read too much into what he has to say. If you're concerned, check the version of OpenSSH on FreeBSD and the OpenSSH on OpenBSD, diff the two, and analyze the differences.

share|improve this answer
1  
Theo may be an arsehole, but his statements are normally technically sound. From my reading of his statement, there is a problem with the underlying operating system that makes running (unmodified) portable-OpenSSH on FreeBSD and derivates less secure. Disclaimer: I founded MirBSD because of… communication problems… with the OpenBSD people, but I still consider them technically good. (I do question and review stuff from them occasionally.) –  mirabilos Apr 13 at 9:56
    
If there is a flaw that makes OpenSSH less secure on FreeBSD and derivatives, hence a "hole", then I would argue that it's an OpenSSH problem not a FreeBSD problem. –  Scott Apr 14 at 12:44
    
Scott, feel free to argue however much you want, as you arguïng won’t change reality. If there is a problem in the underlying operating system, the situation is often that you either cannot work around it (it simply is not possible technically) or do not want to (as publishing a workaround would expose the security problem in the base OS, which may still be under embargo; or if there is not enough incentive for you to do so; or if it’s not worth the effort or introduces other problems). –  mirabilos Apr 14 at 16:09
    
It depends on the nature of the problem. If the problem is "FreeBSD doesn't implement ASLR by default", for example, then the problem is that there's a hole in OpenSSH that is mitigated by ASLR, not just that FreeBSD doesn't do the right thing. This is why I said to examine a diff of the source codes and see what has changed. If nothing is different, then what in OpenSSH is exploitable? –  Scott Apr 14 at 16:11
    
You don't understand. I'm too exhausted by last week to want to argue. I rest my case. –  mirabilos Apr 14 at 17:58
show 5 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.