Critical Security Vulnerability with Linux OpenSSH
(But don’t panic)

This affects most VPS servers with SSH:
Allows remote execution of code

Nicknamed "RegreSSHion", a play on words

Key points:
--Let’s not panic, it’s difficult to pull off
--No known wild exploits
--You should update your VPS asap, but don’t panic about it
--Attack takes 8 hours to complete [1]
--Attack may require up to 10,000 authentication steps [1]
--Attackers must also know the specific OS running on each targeted server. [1]
--No one has found a way to exploit 64-bit systems [1]
--Many distros have patches including Ubuntu [2][3]
--Update with the patches, you’ll be ok (Use Fail2Ban too)
--Affects OpenSSH server versions 8.5p1-9.8p1
--Palo Alto Networks was NOT able to pull it off in the wild [4]

Before you panic, read this from Palo Alto:

“While there is PoC code for this vulnerability, there is no known activity in the wild as of July 2, 2024. Our testing of this code suggests it is not functional in our testing environment. We have been unable to successfully exploit the CVE-2024-6387 vulnerability with this PoC to achieve remote code execution.” [4]

Bottom line: Update with the patches.

Sources:

[1]
https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/
[2]
https://security-tracker.debian.org/tracker/source-package/openssh
[3]
https://ubuntu.com/blog/ubuntu-regresshion-security-fix
[4]
https://unit42.paloaltonetworks.com/threat-brief-cve-2024-6387-openssh/