Nasty regreSSHion bug in OpenSSH puts roughly 700K Linux boxes at risk

[{"selector":"#anim-e35cc0c4-3210-4774-9167-ced58a231a4e","keyframes":{"opacity":[0,1]},"delay":500,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-7b20d7a0-32c7-4eb4-889e-7856cbd77ffd","keyframes":{"transform":["translate3d(-118.21191%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":500,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] Nasty regreSSHion bug in OpenSSH puts roughly 700K Linux boxes at risk

New Vulnerability in OpenSSH

[{"selector":"#anim-651c548b-4d4b-4909-b13d-f6fffdddceb5","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-087f66f1-3650-424f-a475-918499ed2670","keyframes":{"transform":["translate3d(0px, 99.84351%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-53a03646-6a90-42e2-80b8-21777678ef85","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-668ade4b-80dd-4295-9909-2b02d2c0c057","keyframes":{"transform":["translate3d(-118.18182%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-e39331d4-41cb-47a5-ba70-c696cc9da7e9","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-be90f80d-3df4-4a28-9174-c0ffb175f9ce","keyframes":{"transform":["translate3d(-118.18182%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] Glibc-based Linux systems urged to update due to a critical flaw in sshd, potentially leading to remote code execution.

Scope and Impact

[{"selector":"#anim-ad57b293-e411-44e7-a011-3ac07086193e","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-2f71821b-72b8-46a6-99bf-78f78839671c","keyframes":{"transform":["translate3d(0px, 99.84351%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-e2e7068b-7afb-491b-9347-97865070bd91","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-81f40fc1-c62d-483a-9c3a-0b5bb1a1274a","keyframes":{"transform":["translate3d(-118.18182%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-431a0359-eb2e-42e7-a3e1-7de0705d3440","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-a378091c-b8c8-49db-8363-e2d063746821","keyframes":{"transform":["translate3d(-118.18182%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] Qualys reports 700,000 vulnerable internet-facing sshd instances, highlighting the severity of the regression vulnerability dubbed "regreSSHion."

Root Cause and History

[{"selector":"#anim-a91d8a39-f47e-4fee-a968-a3478d08be93","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-e86d9867-2fcd-4985-8bfa-1f527e7d0094","keyframes":{"transform":["translate3d(0px, 99.84351%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-97af9caf-4235-4547-bc5b-a8159e8d045d","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-c4ec70a9-10cb-4a9b-8eee-76dd44445335","keyframes":{"transform":["translate3d(-118.18182%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-4e0e4856-5318-42ec-989b-1f5854ed6b29","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-d54d1ba0-70d3-4c9b-8926-bc5484bde630","keyframes":{"transform":["translate3d(-118.18182%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] The flaw, a regression of CVE-2006-5051, reappeared in OpenSSH 8.5p1, affecting systems running glibc and possibly enabling full system compromise.

OpenBSD Exception

[{"selector":"#anim-f16accdb-340a-4808-b422-283f6c16c169","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-d86f1fd8-bcb2-4f7f-b991-ace60aa93fc3","keyframes":{"transform":["translate3d(0px, 99.84351%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-b8d945d6-7684-4204-a7bb-6f6cf113e66b","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-80821d2e-00df-4204-b903-817692d49992","keyframes":{"transform":["translate3d(-118.18182%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-ae2eb8ee-ec6d-4b70-bd57-78689108355d","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-8bbf785b-bdbf-486e-8a43-ac0a1139817d","keyframes":{"transform":["translate3d(-118.18182%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] Systems running OpenBSD are immune due to a security enhancement implemented in 2001, safeguarding against the vulnerability in syslog().

Technical Details

[{"selector":"#anim-a8ff591a-fb25-4cbe-8193-567399c70596","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-6ae215e5-218d-42d3-adcb-5d149438489b","keyframes":{"transform":["translate3d(0px, 99.84351%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-746797bf-b996-4a4e-8369-3e7fb109c857","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-72b02141-10cf-4aa3-a3b9-44d4942ea41d","keyframes":{"transform":["translate3d(-118.18182%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-fc182ee6-ffe8-45a6-a7ec-604b11f3ad40","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-fc74a399-b328-440a-8a61-a3eb4420ec67","keyframes":{"transform":["translate3d(-118.18182%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] Exploitation involves a race condition in the SIGALRM handler, potentially allowing attackers to execute arbitrary code and evade security measures.

Patching Efforts

[{"selector":"#anim-ff46d856-5bc1-46f6-b750-17151b279e2a","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-ef9f2fb2-5313-47da-8dce-80fc91be08b6","keyframes":{"transform":["translate3d(0px, 99.84351%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-e99438b7-c0a5-4d92-a2a4-8c94a803ca0f","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-eaec0ec4-2500-4c56-8a0f-ab595a4e16d0","keyframes":{"transform":["translate3d(-118.18182%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-9cea892f-9043-4790-ba16-510dbc57af61","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-94430f7b-e1f5-44ed-adc3-86add01ff717","keyframes":{"transform":["translate3d(-118.18182%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] OpenSSH versions earlier than 4.4p1 and 8.5p1 to 9.8p1 are vulnerable unless patched for CVE-2006-5051 and CVE-2008-4109.

Mitigation Strategies

[{"selector":"#anim-f2aed440-d06a-41de-b374-8c13d312aeb0","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-a13948ba-7c05-4e2b-b1d6-444a1ccdcaa9","keyframes":{"transform":["translate3d(0px, 99.84351%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-58657f3c-5aa6-4cfc-81c4-d45cf3c0a6d9","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-858ca10e-2c8c-4582-b66c-0d3399b2e4bb","keyframes":{"transform":["translate3d(-118.18182%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-1a678460-1a99-423b-ad01-19c535bc6028","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-8e4872bd-a400-4b8a-a6e1-48c990feca90","keyframes":{"transform":["translate3d(-118.18182%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] Organizations are advised to apply patches promptly, restrict SSH access, and monitor networks for exploit attempts to mitigate risk.

Community Response

[{"selector":"#anim-e44e864a-ea73-490e-9356-97792c3b976d","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-229bce95-2105-49d2-85d3-6de9b652bb5b","keyframes":{"transform":["translate3d(0px, 99.84351%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-4438ae02-fb28-4818-9e84-27320ca6885d","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-0d09c5d3-3765-4d17-bdee-a3b773861223","keyframes":{"transform":["translate3d(-118.18182%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-12334f6b-fb79-4158-8928-e672b7626c6c","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-ea684cda-c46e-42cf-a1a7-3af468c4e9c8","keyframes":{"transform":["translate3d(-118.18182%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] The Linux community is rallying to share information and resources to help affected users secure their systems.

Industry Responses

[{"selector":"#anim-d5d046fe-f0f7-40ff-8b7a-52ad30c7c742","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-9df8632f-66b2-4bd4-96f1-3b1c86698cd9","keyframes":{"transform":["translate3d(0px, 99.84351%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-ed55667e-e384-475f-8566-ac8a8928dc6c","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-934a6dae-012e-4bcd-a5c9-8129429d4ff3","keyframes":{"transform":["translate3d(-118.18182%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-98f55fe7-dabf-41d0-b6b8-8aa77c7aa52c","keyframes":{"opacity":[0,1]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-e4da098d-41e3-45af-8921-67c2c036b3d5","keyframes":{"transform":["translate3d(-118.18182%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] Ubuntu and NixOS have released updates, emphasizing the importance of checking for patches across Linux distributions.