Re: OpenSSH Protocol 1

> I've seen a lot of articles on this, but I'm very curious about the
> vulnerability with OpenSSH protocol 1.

There is no vulnerability with protocol 1.  Some people have stomped
up and down over this meme (look up the word meme if you do not know
exactly what it means).  It is absolute bullshit peddled by a few
people who think they know something, but they don't, and then they
spread fear.

Protocol 1 uses a CRC to validate the packets in its stream, and this
in the past was a super bad idea.  Some improvements have been made,
but it is still too bad that protocol 1 never moved to a full hmac.
This is a weakness, yes, but it is not a vulnerability at any level.

The protocol 2 implimentation uses probably about 5x as much code and
complexity to move packets.  It was designed better, but it also has
signicant more complexity.  The use of DH up front makes some people
choose protocol 1 for slower machines, because the DH is so slow.  If
a coding vulnerability is going to be found in the future, I would
expect it to be found in the protocol 2 code.

I have said only a few words on this, but I think you can already see
how the situation is not as clear as some think.  Yet they preach.
Quite frankly those people are using the wrong words to describe the
issue, and this is because they do not have the skills to explain the
complicated issues.

> The fix for us has been to
> disable Protocol 1, however on a re-install of a newer version the
> config will default back to Protocol 1.

How is that a fix?  Is that like wrapping duct tape around your car
tires so that they won't explode when one of them springs a leak?  It
is a sad day when security professionals start thinking in this
particular way.

> 	What is the latest version of OpenSSH where protocol 1 does not
> have a vulnerability, or does this exist? If SRRs are run against a
> particular system, no potential vulnerabilities are reported.  However,
> Nessus reports a possible vulnerability.

Then Nessus is written by a bunch of meme-propogating idiots.  And you
can quote me on that.