http://www.theregister.co.uk/2009/05/19/open_ssh_hack/A security vulnerability has been discovered in the OpenSSH secure shell implementation whereby an attacker has a one in 262,144 chance of recovering 32 bits of plaintext from an arbitrary chunk of ciphertext. Although the odds are stacked incredibly high against the attacker, certain VPN implementations are made vulnerable by the high frequency of reconnections that occur.
Cryptographers are urging users of a widely employed network protocol to make sure they're running the latest version after discovering a flaw that could allow attackers to read data that's supposed to remain encrypted.
All programs that incorporate the OpenSSH implementation of SSH, short for Secure Shell, should make sure they use version 5.2, which provides several countermeasures to prevent the attacks. Other SSH implementations may be vulnerable as well, the researchers from the Information Security Group at the University of London's Royal Holloway said.
