beloved patriot in encryption armor discovered

[r_manic]

An underlying flaw in the widely used encryption protocol Open Secure Shell (OpenSSH) has been made public by researchers from the Royal Holloway, University of London.

The flaw, which lies in version 4.7 of OpenSSH on Debian/GNU Linux, allows 32 bits of encrypted text to be rendered in plaintext, according to a research team from the Royal Holloway Information Security Group (ISG).

Source

 

[linux_0]

5.2 contains countermeasures, so this should already be fixed.

 

[j29ville]

Glad to hear it... and current users were automatically updated to 5.2 a long time ago right?

 

[MrLinux]

This is the big selling-point of Open Source; if it had been a Closed Source project, no one would have found the problem untill AFTER it had been exploited.

 

[linux_0]

MrLinux is right, most projects patch their code quickly.

Most closed source companies take years to patch problems if they ever patch them at all.

Besides when you have the source code you can fix the problem yourself, employ countermeasures or use different software.

I think this particular bug only affects Debian distros.

 

[randomizer]

Besides when you have the source code you can fix the problem yourself, employ countermeasures or use different software.

Providing you know how of course

 

[linux_0]

You can also get someone to patch the code for you, either for free or for a fee.

Some projects release workarounds or a temporary patch if they are unable to release a patch immediately.

The point is you have a bazillion options

With closed source and vendor lock in you are at the mercy of the vendor. You have no way to audit the source code or anything like that. In most cases if you attempt to patch closed source software, perform security testing or disclose vulnerabilities, you can end up getting in serious legal trouble.

 

[randomizer]

At least Microsoft is reasonably quick (for a vendor) to release patches once a vulnerability has been discovered. Problem is their updates often cause more problems :lol:

 

[linux_0]

There's some bugs that have been around 20 years that are still not fixed and as you said their patches tend to cause more problems than they solve :lol: