And the article listed states that this version isn't affected.
My Ubuntu machine is on version Version: 1:8.9p1-3ubuntu0.7 and looks like this version IS affected by this bug. I'm on the jammy release and they have released a new version that fixes this problem, so just a quick update should fix the issue.
Turn it on when you need it, then turn it pack off.
I agree, this is very good advice. I guess it depends on who is using it but many have network storage and use Samba. Not sure how Samba shakes up with openssh, but I'd assume it's just as vulnerable.
I got to spend Friday ACLing access which was once much more open, it was a lame day. Fortunately updates were easy to apply once the patch was released.
This one had chatter in some of the infosec circles, but what bugs me is the patch was released in near timing of the announcement, preventing many systems from auto updating. Details about the scope of the vulnerability were kept quite hidden too, so we spent a chunk of time locking things down that didn't need it.
2022 and after, along with much older versions. I didn't run Ubuntu in the olden days, but older versions of openssh were vulnerable too.
As far as I can tell today the work was for not. We ban connections if they fail to auth successfully the first time and what I've been reading is that the attack is a timing attack requiring many attempts to get in (somewhere around 1 in 10k attempts for a success rate).
[ + ] Empire_of_the_Mind
[ - ] Empire_of_the_Mind 3 points 11 monthsJul 1, 2024 15:32:58 ago (+3/-0)
[ + ] ilikeskittles
[ - ] ilikeskittles 1 point 11 monthsJul 2, 2024 09:44:44 ago (+1/-0)
[ + ] Dingo
[ - ] Dingo [op] 0 points 11 monthsJul 2, 2024 12:34:18 ago (+0/-0)
I agree, this is very good advice. I guess it depends on who is using it but many have network storage and use Samba. Not sure how Samba shakes up with openssh, but I'd assume it's just as vulnerable.
Sneaker-net for the win I guess.
[ + ] mannerbund
[ - ] mannerbund 1 point 11 monthsJul 1, 2024 18:56:42 ago (+1/-0)
I got to spend Friday ACLing access which was once much more open, it was a lame day. Fortunately updates were easy to apply once the patch was released.
This one had chatter in some of the infosec circles, but what bugs me is the patch was released in near timing of the announcement, preventing many systems from auto updating. Details about the scope of the vulnerability were kept quite hidden too, so we spent a chunk of time locking things down that didn't need it.
[ + ] Dingo
[ - ] Dingo [op] 0 points 11 monthsJul 2, 2024 12:43:28 ago (+0/-0)
Do you mean 22.04 and before or 22.04 and after?
[ + ] mannerbund
[ - ] mannerbund 1 point 11 monthsJul 2, 2024 15:29:29 ago (+1/-0)
As far as I can tell today the work was for not. We ban connections if they fail to auth successfully the first time and what I've been reading is that the attack is a timing attack requiring many attempts to get in (somewhere around 1 in 10k attempts for a success rate).