Mailing List Archive: Check if J-PAKE enabled?

Check if J-PAKE enabled?

Jan 13, 2011, 8:36 AM

Post #1 of 2 (5401 views)

Reading the vulnerability related to J-PAKE (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4478) it seems J-PAKE support is experimental and not normally enabled. Is there an easy way to verify this from a running instance?

Specifically I want to check that a server running 5.6p1 in cygwin (the currently available pre-compiled version) does not have it enabled.

RE: Check if J-PAKE enabled? [ In reply to ]

Joachim.Thuau at heavy-iron

Jan 13, 2011, 3:37 PM

Post #2 of 2 (5338 views)

Permalink

You should be able to cross reference your existing build with the source from cygwin here:

http://cygwin.com/packages/openssh/

and

ftp://ftp.cygwin.com/pub/cygwin/release/openssh/

and verify if it's enabled or not, and even if it's enabled, if a fix has been included.
(the makefile should have pretty good descriptions of what options were used for the binary package).

Thanks,
Jok