OpenSSH Security Advisory (adv.iss)

[Bob Van Cleef]

On Wed, 26 Jun 2002, Markus Friedl wrote:

> 2. Impact:
> 
>         This bug can be exploited remotely if
>         ChallengeResponseAuthentication is enabled in sshd_config.
> 

Question:  If ChallengeResponseAuthentication is set to 'no' in
sshd_config, can the bug be exploited in OpenSSH_3.1p1?  

Bob