F-Secure Corporation Not Affected

Updated:  July 28, 2005

Status

Not Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

According to WRQ, F-Secure SSH for Windows did not support this type of authentication, and is therefore not vulnerable.

WRQ, Inc. Affected

Updated:  July 28, 2005

Status

Affected

Vendor Statement

Workaround #1: Change the server configuration using the GUI as follows: Add the string 'administrator' (without the quotation marks) to the Deny login for users in User Restrictions. Create a subconfiguration entry in the Advanced screen by adding a UserSpecificConfig line to the end of the file, for example: "UserSpecificConfig New-Admin-Name admin.config" Click the Apply button to notify the running server of the changes. Create a file named admin.config in the folder where the server was installed (usually C:\Program Files\F-Secure\ssh server) that contains the following line: UserConfigDirectory "C:\\Documents and Settings\\administrator\\.ssh2" Note: The doubled \\ are required. Both the sshd2_config and admin.config files should have their file protections changed to permit only the Administrator group to access to these files. Workaround #2: Create a folder in the "Documents and Settings" folder with the renamed user name (such as, New-Admin-Name) and create a .ssh2 folder there (for example, C:\Documents and Settings\New-Admin-Name\.ssh2. Then move - do not copy - all public key files and the authorization file to this new folder. Remember to set the file protections on these folders to permit only the New-Admin-Name user access to these files.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.