OpenBSD, FreeBSD and Unix exposed, again
C|Net | at | by Mike
A popular open-source program for encrypted communications has a serious flaw that could let Internet attackers slip into servers running the software, said its creators and a security company this week. The program, Open Secure Shell (OpenSSH), is included in many widely used operating system distributions, such as OpenBSD 3.0, OpenBSD 3.1 and FreeBSD-Current, all open-source variants of the Unix OS. Such operating systems appear on networking equipment and security appliances, among other things. Slender said the flaw involves OpenSSH's inadequate handling of "buffer overflow" attacks, in which a message sent to a program is much longer than the program is designed to expect. Attackers exploit such holes by flooding programs with more characters than they can accommodate and running the excess characters as executable code.