RE: [VulnDiscuss] Re: iDEFENSE Security Advisory 01.28.03: SSH2 Clients Insecurely Store Passwords
David Endler <[email protected]>
| Newsgroups | gmane.comp.security.vulnerabilities.watch.general |
|---|---|
| Message-ID | <[email protected]> |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Dragos, Non issue? Even though it's a low severity risk, isn't it plausible that memory containing this sensitive information gets swapped to disk? After I had ssh'd from a computer only *once* in a shared environment (kiosk, lab, etc), couldn't someone could still compromise it afterward and gain those credentials to other systems? - -dave > -----Original Message----- > From: Dragos Ruiu [mailto:[email protected]] > Sent: Wednesday, January 29, 2003 5:39 AM > To: [email protected]; [email protected] > Subject: [VulnDiscuss] Re: [VulnWatch] iDEFENSE Security Advisory > 01.28.03: SSH2 Clients Insecurely Store Passwords > > > On January 29, 2003 05:51 pm, iDEFENSE Labs wrote: > > AbsoluteTelnet, SecureCRT, Entunnel, SecureFx, and PuTTY do > not properly > > scrub memory allowing an attacker with access to memory or > a memory dump > > to retrieve authentication information. > > If they have access to your raw mem... you've got bigger > issues than this. > Many other avenues exist to said credentials no matter what > Putty et al do... > > Non-issue. -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 Comment: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE4A96E4F iQA/AwUBPjlR6ErdNYRLCswqEQLhTQCffGujU6yGCrJaxutaCrAUPeV6OGwAoJ9o 6FHwoW1YV+mUUuMjvmpR8iP0 =8ZwC -----END PGP SIGNATURE-----