sshd: buffer_get trying to get more bytes than in buffer

[Toomas Aas]

Hi!

Matthew Seaman wrote:

> On Mon, Apr 21, 2003 at 11:20:21AM +0300, Toomas Aas wrote:
> > I've noticed that one of my users logging in via ssh from one particular IP
> > always causes this message to appear in auth.log:
> > 
> > Apr 20 15:43:18 heerold sshd[18766]: fatal: buffer_get: trying to get more bytes 4 than in buffer 0
> > 
> > The same user logs in from several different IP-s and the message only
> > appears when he logs in from one particular IP. This leads me to believe
> > that it might be just a quirk in the SSH client software he uses on this
> > particular PC, but I just wanted to confirm that it's not actually an
> > indication of Something Evil in progress.
> 
>     http://www.securityfocus.com/archive/121/261925/2002-03-08/2002-03-14/2
> 
> Looks like damage to the user's authorized_keys file:

In this case it seems to be something else, because this user doesn't
even have authorized_keys (nor authorized_keys2) files in ~/.ssh

But thanks anyway.
--
Toomas Aas | toomas.aas at raad.tartu.ee | http://www.raad.tartu.ee/~toomas/
* I spilled spot remover on my dog. Now he's gone.