--a+b56+3nqLzpiR9O Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Jul 10, 2002 at 11:11:18AM -0400, Matt Miller wrote: > =20 > I am running OpenSSH 3.1p1. I did read that the new version of ssh will > break PAM if "UsePrivilegeSeparation" is set to "yes" in the correct it will, and your version has a exploitable root hole in the PAM keyboard interactive bits. unfortunatly you get to choose exploitable root hole or no properly working passwd expiration in ssh at this point. (passwds will expire and ssh will honor that by happily denying access, giving no opertunity to pick a new password). --=20 Ethan Benson http://www.alaska.net/~erbenson/ --a+b56+3nqLzpiR9O Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iEYEARECAAYFAj0sjVIACgkQJKx7GixEevzJswCeLNqc1UfFaaBdYic+XMoWygda QO8AoJOOohsoebOR/2XVsLH48XE79b+M =Y65O -----END PGP SIGNATURE----- --a+b56+3nqLzpiR9O--
