SSH server 0-day exploit - Suggestions to protect ourselves
In light of the current speculation of a new 0-day exploiting a remote vulnerability against OpenSSH, I'm curious to answer a couple of questions.
- What steps do you take to mitigate this risk.
Implement hard ingress filters? I understand that at least one major hosting provider has done this.
Disable the service until risk is better understood? Can you rapidly identify running versions across your network.
- How do you verify the extent of the risk
In-house source code eval? Do you have those skills.
Favorite security sites/feeds? How do you determine fact from rumor.
- How does your change management system deal with these changes
Have an expedited process for emergency changes? Can you pull an eval and execute a plan in 1 day.