I can see:

Only two remote holes in the default install, in a heck of a long time!

I understand the concept what are they pointing out, since other OSes have much-much-much more remote code execution holes historically, smbfs, etc.

I even found the second hole they are pointing out: https://lwn.net/Articles/225947/ - CORE-2007-0219: OpenBSD's IPv6 mbufs remote kernel buffer overflow

But the Q: what was the first remote hole they are pointing out?

2 Answers 2


From the Wikipedia: Security record

In June 2002, Mark Dowd of Internet Security Systems disclosed a bug in the OpenSSH code implementing challenge-response authentication. This vulnerability in the OpenBSD default installation allowed an attacker remote access to the root account, which was extremely serious not only to OpenBSD, but also to the large number of other operating systems that were using OpenSSH by that time. This problem necessitated the adjustment of the slogan on the OpenBSD website to:

"One remote hole in the default install, in nearly 6 years! "
  • 1
    Thanks! but stoney was few mins faster. But still many thanks! Jan 8, 2020 at 14:13
  • 2
    It doesn't matter who posted first, but if you're going to accept an answer based on that, GAD3R actually answered first, at 2020-01-08 13:11:31Z, followed by stoney at 2020-01-08 13:17:41Z. (Hover over the "xxx ago" part of the "answered xxx ago" texts to see).
    – Jeff Schaller
    Jan 8, 2020 at 18:20


Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication) when OpenSSH is using SKEY or BSD_AUTH authentication.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.