thr3ads.net - openssh unix dev - openssh 2.9p2 release 8.7 security alert!!! [Nov 2001]

If this information is useful, please help other people find it:
Share via:

Pin Lu

2001-Nov-29 07:07 UTC

openssh 2.9p2 release 8.7 security alert!!!

Hi, everyone:

My system was compromised a few days ago.
The cracker attacked the system through openssh 2.9p2 release 8.7.
I attached part of the log file.


Thanks.

Pin Lu (pin at stredo.com)


Nov 25 11:33:05 ns sshd[10627]: Disconnecting: Corrupted check bytes on
input.
Nov 25 11:33:36 ns named[10478]: Lame server on
'55.254.58.211.in-addr.arpa'
(in '254.58.211.in-addr.arpa'?): [210.180.98.69].53
'ns2.hananet.net'
Nov 25 11:33:36 ns named[10478]: Lame server on
'55.254.58.211.in-addr.arpa'
(in '254.58.211.in-addr.arpa'?): [210.94.0.7].53
'ns.hananet.net'
Nov 25 11:33:36 ns named[10478]: ns_forw: query(55.254.58.211.in-addr.arpa)
All possible A RR's lame
Nov 25 11:33:45 ns sshd[10689]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:33:45 ns sshd[10690]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:33:46 ns sshd[10691]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:33:46 ns sshd[10692]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:33:47 ns sshd[10693]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:33:48 ns sshd[10694]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:33:49 ns sshd[10696]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:33:50 ns sshd[10698]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:33:50 ns sshd[10700]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:33:51 ns sshd[10701]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:33:51 ns sshd[10702]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:33:52 ns sshd[10703]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:33:59 ns sshd[10714]: Disconnecting: Corrupted check bytes on
input.
Nov 25 11:34:00 ns sshd[10715]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:34:01 ns sshd[10716]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:34:02 ns sshd[10717]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:34:02 ns sshd[10718]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:34:03 ns sshd[10719]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:34:03 ns sshd[10720]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:34:05 ns sshd[10722]: Disconnecting: Corrupted check bytes on
input.
Nov 25 11:34:05 ns sshd[10723]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:34:06 ns sshd[10724]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:34:06 ns sshd[10725]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:34:07 ns sshd[10726]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:34:08 ns sshd[10727]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:34:08 ns sshd[10728]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:34:40 ns sshd[10771]: Disconnecting: Corrupted check bytes on
input.
Nov 25 11:35:21 ns sshd[10832]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:21 ns sshd[10833]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:22 ns sshd[10834]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:22 ns sshd[10835]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:23 ns sshd[10836]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:24 ns sshd[10837]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:24 ns sshd[10838]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:25 ns sshd[10840]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:26 ns sshd[10841]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:27 ns sshd[10842]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:34 ns sshd[10854]: Disconnecting: Corrupted check bytes on
input.
Nov 25 11:35:35 ns sshd[10855]: Disconnecting: Corrupted check bytes on
input.
Nov 25 11:35:36 ns sshd[10856]: Disconnecting: Corrupted check bytes on
input.
Nov 25 11:35:36 ns sshd[10857]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:37 ns sshd[10858]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:37 ns sshd[10859]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:38 ns sshd[10860]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:45 ns sshd[10871]: Disconnecting: Corrupted check bytes on
input.
Nov 25 11:35:46 ns sshd[10872]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:46 ns sshd[10873]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:47 ns sshd[10874]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:48 ns sshd[10875]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:48 ns sshd[10876]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:49 ns sshd[10877]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:50 ns sshd[10878]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:50 ns sshd[10879]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:51 ns sshd[10881]: Disconnecting: Corrupted check bytes on
input.
Nov 25 11:35:52 ns sshd[10882]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:53 ns sshd[10883]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:53 ns sshd[10884]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:35:54 ns sshd[10885]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:36:25 ns named[10478]: denied update from [24.184.45.120].3015 for
"echasqui.com"
Nov 25 11:36:49 ns sshd[10914]: Disconnecting: Corrupted check bytes on
input.
Nov 25 11:37:28 ns sshd[10975]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:37:29 ns sshd[10976]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:37:30 ns sshd[10977]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:37:30 ns sshd[10978]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:37:31 ns sshd[10979]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:37:32 ns sshd[10980]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:37:32 ns sshd[10981]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:37:33 ns sshd[10982]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:37:33 ns sshd[10983]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:37:35 ns sshd[10985]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:37:35 ns sshd[10986]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:37:36 ns sshd[10987]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:37:37 ns sshd[10988]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:37:37 ns sshd[10989]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:37:38 ns sshd[10990]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:37:38 ns sshd[10991]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:37:39 ns sshd[10992]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:37:40 ns sshd[10993]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:37:40 ns sshd[10994]: Disconnecting: crc32 compensation attack:
network attack detected
Nov 25 11:37:48 ns sshd[11006]: Disconnecting: Corrupted check bytes on
input.
Nov 25 11:37:53 ns sshd[11013]: Disconnecting: Corrupted check bytes on
input.
Nov 25 11:37:54 ns sshd[11014]: Disconnecting: Corrupted check bytes on
input.
Nov 25 11:40:00 ns CROND[11022]: (root) CMD (   /sbin/rmmod -as)
Nov 25 11:40:08 ns adduser[11023]: new group: name=mattanl, gid=528
Nov 25 11:40:08 ns adduser[11023]: new user: name=mattanl, uid=528, gid=528,
home=/home/mattanl, shell=/bin/bash
Nov 25 11:40:27 ns adduser[11027]: new group: name=mattan, gid=529
Nov 25 11:40:27 ns adduser[11027]: new user: name=mattan, uid=0, gid=529,
home=/home/mattan, shell=/bin/bash
Nov 25 11:40:52 ns PAM_unix[11032]: (system-auth) session opened for user
mattanl by (uid=0)
Nov 25 11:40:52 ns  -- mattanl[11032]: LOGIN ON pts/1 BY mattanl FROM
PT712079.bezeqint.net
Nov 25 11:41:49 ns PAM_unix[11054]: (system-auth) session opened for user
mattan by mattanl(uid=528)
Nov 25 11:43:08 ns sshd[577]: Generating new 768 bit RSA key.
Nov 25 11:43:08 ns sshd[577]: RSA key generation complete.
Nov 25 11:44:09 ns PAM_unix[11054]: (system-auth) session closed for user
mattan
Nov 25 11:44:10 ns modprobe: modprobe: Can't locate module binfmt-0000
Nov 25 11:44:10 ns modprobe: modprobe: Can't locate module binfmt-0000
Nov 25 11:44:10 ns in.telnetd: PT712079.bezeqint.net
[14364]: /bin/login: Exec format error
Nov 25 11:45:01 ns PAM_unix[14367]: authentication failure; (uid=0) ->
mattanl for system-auth service
Nov 25 11:45:07 ns named[10478]: Lame server on
'55.254.58.211.in-addr.arpa'
(in '254.58.211.in-addr.arpa'?): [210.94.0.7].53
'ns.hananet.net'
Nov 25 11:45:07 ns named[10478]: Lame server on
'55.254.58.211.in-addr.arpa'
(in '254.58.211.in-addr.arpa'?): [210.180.98.69].53
'ns2.hananet.net'
Nov 25 11:45:07 ns named[10478]: ns_forw: query(55.254.58.211.in-addr.arpa)
All possible A RR's lame
Nov 25 11:45:07 ns sshd[14367]: Could not reverse map address 211.58.254.55.
Nov 25 11:45:07 ns sshd[14367]: Accepted password for mattanl from
211.58.254.55 port 1023 ssh2
Nov 25 11:45:08 ns PAM_unix[14367]: (system-auth) session opened for user
mattanl by (uid=0)
Nov 25 11:46:19 ns PAM_unix[14384]: (system-auth) session opened for user
mattan by mattanl(uid=528)
Nov 25 11:47:06 ns PAM_unix[14367]: (system-auth) session closed for user
mattanl
Nov 25 11:47:07 ns PAM_unix[14384]: (system-auth) session closed for user
mattan

Damien Miller

2001-Nov-29 07:59 UTC

head link

openssh 2.9p2 release 8.7 security alert!!!

On Thu, 29 Nov 2001, Pin Lu wrote:
> Hi, everyone:
> 
> My system was compromised a few days ago.
> The cracker attacked the system through openssh 2.9p2 release 8.7.
> I attached part of the log file.
What is release 8.7? What operating system?

-d

-- 
| By convention there is color,       \\ Damien Miller <djm at
mindrot.org>
| By convention sweetness, By convention bitterness, \\ www.mindrot.org
| But in reality there are atoms and space - Democritus (c. 400 BCE)

Wojtek Pilorz

2001-Nov-29 08:11 UTC

head link

openssh 2.9p2 release 8.7 security alert!!!

On Thu, 29 Nov 2001, Damien Miller wrote:
> Date: Thu, 29 Nov 2001 18:59:11 +1100 (EST)
> From: Damien Miller <djm at mindrot.org>
> To: Pin Lu <pin at stredo.com>
> Cc: openssh-unix-dev at mindrot.org
> Subject: Re: openssh 2.9p2 release 8.7 security alert!!!
> 
> On Thu, 29 Nov 2001, Pin Lu wrote:
> 
> > Hi, everyone:
> > 
> > My system was compromised a few days ago.
> > The cracker attacked the system through openssh 2.9p2 release 8.7.
> > I attached part of the log file.
> 
> What is release 8.7? What operating system?
I guess this was RedHat Linux 7.0 or 7.1;
ftp://updates.redhat.com contains
7.0/en/os/SRPMS/openssh-2.9p2-8.7.src.rpm
and 
7.1/en/os/SRPMS/openssh-2.9p2-8.7.src.rpm
(which are identical)

and resulting binary packages (also identical for 7.0 and 7.1, at least
for x86)



> 
> -dBest regards,

Wojtek

Kent Engström

2001-Nov-30 11:56 UTC

head link

openssh 2.9p2 release 8.7 security alert!!!

Pin Lu <pin at stredo.com> writes:> Hi, everyone:
> 
> My system was compromised a few days ago.
> The cracker attacked the system through openssh 2.9p2 release 8.7.
> I attached part of the log file.
It would be very nice (though it would of course be even nicer to find
out that it wasn't) to be more sure that 2.9p2 was actually up and
running on port 22 of the computer in question.  I have personally
told people to upgrade, received "OK, done."  and then still found
them running the old version, because the SSH server was not restarted
at upgrade time.

Unfortunately, that information is not available in the log below.

Perhaps version information could be included in some periodical
messages (such as "Generating new 768 bit RSA key.") or in 
"security alert messages" such as "...crc32 compensation
attack..."

> 
> 
> Thanks.
> 
> Pin Lu (pin at stredo.com)
> 
> 
> Nov 25 11:33:05 ns sshd[10627]: Disconnecting: Corrupted check bytes on
> input.
> Nov 25 11:33:36 ns named[10478]: Lame server on
'55.254.58.211.in-addr.arpa'
> (in '254.58.211.in-addr.arpa'?): [210.180.98.69].53
'ns2.hananet.net'
> Nov 25 11:33:36 ns named[10478]: Lame server on
'55.254.58.211.in-addr.arpa'
> (in '254.58.211.in-addr.arpa'?): [210.94.0.7].53
'ns.hananet.net'
> Nov 25 11:33:36 ns named[10478]: ns_forw: query(55.254.58.211.in-addr.arpa)
> All possible A RR's lame
> Nov 25 11:33:45 ns sshd[10689]: Disconnecting: crc32 compensation attack:
> network attack detected[...]


-- 
Kent Engstr?m,		Link?ping University Incident Response Team
kent at unit.liu.se  	abuse at liu.se
+46 13 28 1744

UNIT, Link?ping University; SE-581 83  LINK?PING; SWEDEN

Jason Stone

2001-Nov-30 13:31 UTC

head link

openssh 2.9p2 release 8.7 security alert!!!

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> My system was compromised a few days ago.
> The cracker attacked the system through openssh 2.9p2 release 8.7.
> I attached part of the log file.
Has this been verified yet by anyone else?  Has there been an announcement
from the openssh core team?


 -Jason

 -----------------------------------------------------------------------
 I worry about my child and the Internet all the time, even though she's
 too young to have logged on yet.  Here's what I worry about.  I worry
 that 10 or 15 years from now, she will come to me and say "Daddy, where
 were you when they took freedom of the press away from the Internet?"
	-- Mike Godwin

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: See https://private.idealab.com/public/jason/jason.gpg

iD8DBQE8B4o0swXMWWtptckRAs1rAKDtV1LUzf2HLM25Zr/cpBW0S15cHwCfXN74
wRqD7vcGsWreX6vHZu6GqAU=BlkM
-----END PGP SIGNATURE-----

Apparently Analagous Threads

Search for more possibly parallel threads

openssh unix dev - Nov 2001 - openssh 2.9p2 release 8.7 security alert!!!

openssh 2.9p2 release 8.7 security alert!!!

openssh 2.9p2 release 8.7 security alert!!!

openssh 2.9p2 release 8.7 security alert!!!

openssh 2.9p2 release 8.7 security alert!!!

openssh 2.9p2 release 8.7 security alert!!!

Apparently Analagous Threads