openssh unix dev - Oct 2003 - OpenSSH 3.4p1 and OpenSSL

Ladies and Gentlemen;
                                     I have multiple systems where all I 
can find is the OpenSSH 3.4p1 installed without the OpenSSL libraries. I 
have other systems that have OpenSSH3.4p1 with OpenSSL 0.9.6e and other systems
with OpenSSH 3.6.1p1 and OpenSSL 0.9.7b installed.
I am trying to respond to the following IAVA CERT Advisory CA-2003-26 Multiple
Vulnerabilities in SSL/TLS
Implementations Original issue date: October 1, 2003 
* OpenSSL versions prior to 0.9.7c and 0.9.6k 
* Multiple SSL/TLS implementations 
* SSLeay library

If someone could please take the time to answer the following questions, I 
would greatly appreciate it.
1. Does OpenSSH 3.4p1 need the OpenSSL libraries to encrypt the data so 
that it can't been seen?
2. If OpenSSH 3.4p1 does not need the OpenSSL libraries to encrypt the 
data so that it can't been seen, then what is the OpenSSL libraries used 
for?
3. I installed the OpenSSH3.4p1 on a Solaris 8 system without the OpenSSL 
libraries. Once installed I was able to do the following:
1. Started snoop in a window. snoop port 22
1. I then executed the following command from another window : 
/usr/local/bin/ssh localhost -l mak
2. I logged in.
3. When I checked the snoop output there was nothing! 
What am I missing here? 
Should snoop have reported output even if it WAS or was NOT encrypted?
How can I find out what version of the OpenSSL libraries are being used by 
the OpenSSH?
How do I test OpenSSH to make sure it is using the OpenSSL libraries?
What are the OpenSSL libraries used for?
I have theorized (guessed) the following:
OpenSSH provides a somewhat generic encrypted secure "tunnel or 
connection" between systems.
OpenSSL provides a higher level or grade of encryption of the data being 
passed thru the "tunnel or connection" between the systems.
I am planning on updating the libraries on those systems that had previous 
version of OpenSSL mentioned above with the openssl 0.9.7c that is suppose 
to address the IAVA. Does this mean I will have to recompile the SSH 
software on those systems?

Any and all help would be greatly appreciated!

Respectfully;
                       Mark Khan

Mark_A_Khan at raytheon.com wrote:
> I have multiple systems where all I
> can find is the OpenSSH 3.4p1 [snip]
> Implementations Original issue date: October 1, 2003
> * OpenSSL versions prior to 0.9.7c and 0.9.6k
> * Multiple SSL/TLS implementations
> * SSLeay library
You should also upgrade OpenSSH or apply the security patch:
http://www.openssh.com/txt/buffer.adv
> If someone could please take the time to answer the following questions, I
> would greatly appreciate it.
> 1. Does OpenSSH 3.4p1 need the OpenSSL libraries to encrypt the data so
> that it can't been seen?
Yes, but just libcrypto.
> 2. If OpenSSH 3.4p1 does not need the OpenSSL libraries to encrypt the
> data so that it can't been seen, then what is the OpenSSL libraries
used
> for?
> 3. I installed the OpenSSH3.4p1 on a Solaris 8 system without the OpenSSL
> libraries. Once installed I was able to do the following:
> 1. Started snoop in a window. snoop port 22
> 1. I then executed the following command from another window :
> /usr/local/bin/ssh localhost -l mak
> 2. I logged in.
> 3. When I checked the snoop output there was nothing!
> What am I missing here?
Solaris can't sniff its loopback interface.  Try it between 2 boxes.
> Should snoop have reported output even if it WAS or was NOT encrypted?
You'll see the traffic either way but if it's encrypted you won't
(shouldn't!) be able to make sense out of it.
> How can I find out what version of the OpenSSL libraries are being used by
> the OpenSSH?
ssh -V
> How do I test OpenSSH to make sure it is using the OpenSSL libraries?
It won't build without them.
> What are the OpenSSL libraries used for?
> I have theorized (guessed) the following:
> OpenSSH provides a somewhat generic encrypted secure "tunnel or
> connection" between systems.
> OpenSSL provides a higher level or grade of encryption of the data being
> passed thru the "tunnel or connection" between the systems.
OpenSSL is used only for its crypto functions.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.