OpenSSH Remote Code Execution Vulnerability exposed, upgrade as soon as possible

OpenSSH Remote Code Execution Vulnerability exposed, upgrade as soon as possible
GuideOn October 21, December 19, a foreign vulnerability PlatformSecurityfocus released the latest OpenSSH (CVE-2016-10009) Remote Code Execution Vulnerability. Because the problem lies in ssh-agent, this process is not started by default and will only be used for password-free login between multiple hosts. The vulnerability exploitation conditions are also harsh, therefore, the official vulnerability rating is only medium-risk ". You still need to upgrade to the latest version as soon as possible.

OpenSSH7.4 was officially released on July 4, December 19, 2016. The new version has been transplanted to support SSH2.0 on Linux, BSD, and other Unix-like platforms, fixes bugs and security issues found in the previous version. Note that the underlying changes of version 7.4 may affect the existing configurations.

CVE No.: CVE-2016-10009

Remote Vulnerability: Yes

Local vulnerability: No

Official rating: medium-risk

Release date: AM

Last Updated: PM

Hazards: hackers can execute remote code through the vulnerability or cause data leakage.

Impact scope: OpenSSH 7.3 and earlier versions

Solution: Use OpenSSHUpgrade to the latest version.

According to the results of the network space search engine ZoomEye,Currently, there are about 19,659,712 OpenSSH devices on the Internet, which may be a potential target of hacker attacks.

Upgrade OpenSSH to the latest version:

Download OpenSSH 7.4software package mongotar.gz]

1. The installation steps are as follows:

tar zxvf openssh-7.4p1.tar.gzcd openssh-7.1./configure --prefix=/usr --sysconfdir=/etc/sshmakemake install

2. Solution to the installation error:

Configure: error: in '/usr/src/openssh-7.4p1 ':

Configure: error: no acceptable C compiler found in $ PATH

Install the gcc compiler:

yum install -y gcc

Configure: error: *** zlib. h missing-please install first or check config. log ***

Install related dependency packages:

yum -y install openssl openssl-devel

View OpenSSH version:

ssh -VOpenSSH_7.4p1, OpenSSL 1.0.1e-fips 11 Feb 2013

From: http://hackernews.cc/archives/3943

Address: http://www.linuxprobe.com/openssh-remote-bug.html