drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in openssh
Name: |
Mehrere Probleme in openssh |
|
ID: |
RHSA-2007:0257-02 |
|
Distribution: |
Red Hat |
|
Plattformen: |
Red Hat Enterprise Linux |
|
Datum: |
Di, 1. Mai 2007, 20:12 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2666 |
|
Applikationen: |
Portable OpenSSH |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
- --------------------------------------------------------------------- Red Hat Security Advisory
Synopsis: Low: openssh security and bug fix update Advisory ID: RHSA-2007:0257-02 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0257.html Issue date: 2007-05-01 Updated on: 2007-05-01 Product: Red Hat Enterprise Linux Keywords: syslog buffer length IPv6 X11 forwarding CVE Names: CVE-2005-2666 - ---------------------------------------------------------------------
1. Summary:
Updated openssh packages that fix a security issue and various bugs are now available.
This update has been rated as having low security impact by the Red Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
3. Problem description:
OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. This package includes the core files necessary for both the OpenSSH client and server.
OpenSSH stores hostnames, IP addresses, and keys in plaintext in the known_hosts file. A local attacker that has already compromised a user's SSH account could use this information to generate a list of additional targets that are likely to have the same password or key. (CVE-2005-2666)
The following bugs have also been fixed in this update:
* The ssh client could abort the running connection when the server application generated a large output at once.
* When 'X11UseLocalhost' option was set to 'no' on systems with IPv6 networking enabled, the X11 forwarding socket listened only for IPv6 connections.
* When the privilege separation was enabled in /etc/ssh/sshd_config, some log messages in the system log were duplicated and also had timestamps from an incorrect timezone.
All users of openssh should upgrade to these updated packages, which contain backported patches to correct these issues.
4. Solution:
Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
5. Bug IDs fixed (http://bugzilla.redhat.com/):
162681 - CVE-2005-2666 openssh vulnerable to known_hosts address harvesting 184357 - buffer_append_space: alloc not supported Error 193710 - [PATCH] audit patch for openssh missing #include "loginrec.h" in auth.c 201594 - sshd does not create ipv4 listen socket for X11 forwarding 203671 - additional (time skewed) log entries in /var/log/secure since U4
6. RPMs required:
Red Hat Enterprise Linux AS version 4:
SRPMS: openssh-3.9p1-8.RHEL4.20.src.rpm 73cd43ad99e6b5eb626914bb65f11d70 openssh-3.9p1-8.RHEL4.20.src.rpm
i386: 355fb0d34d1207f6629f886f8cf3e6c4 openssh-3.9p1-8.RHEL4.20.i386.rpm 5b062f94d91ed8418c45745d8b285bd4 openssh-askpass-3.9p1-8.RHEL4.20.i386.rpm 4c13962301e5f93492fcb02b7f01a7b1 openssh-askpass-gnome-3.9p1-8.RHEL4.20.i386.rpm 029fa6c52dec14626a1e443caecc2300 openssh-clients-3.9p1-8.RHEL4.20.i386.rpm f022d0b8cf19f1118fc7521142e7e71c openssh-debuginfo-3.9p1-8.RHEL4.20.i386.rpm 74c1c9b1293e8e46ecaf46db181d3a1b openssh-server-3.9p1-8.RHEL4.20.i386.rpm
ia64: 063a012cb911cad11e1c6e1f700e46ab openssh-3.9p1-8.RHEL4.20.ia64.rpm 67a3c8ab28bdcefe7b2fb957c933b996 openssh-askpass-3.9p1-8.RHEL4.20.ia64.rpm ce81cfbef39e88997fd9084f04f46f26 openssh-askpass-gnome-3.9p1-8.RHEL4.20.ia64.rpm c7bd82bac6e899e197ce59d4dc061d07 openssh-clients-3.9p1-8.RHEL4.20.ia64.rpm 8bca6d06228a0250582fbb224e14f46b openssh-debuginfo-3.9p1-8.RHEL4.20.ia64.rpm 9110321bf599bf3f29eaccaa32b7ce1d openssh-server-3.9p1-8.RHEL4.20.ia64.rpm
ppc: cac15ade9405e8ef47939842656b6f70 openssh-3.9p1-8.RHEL4.20.ppc.rpm 783a2f6121f3a7373e5f7d7048f95ecd openssh-askpass-3.9p1-8.RHEL4.20.ppc.rpm 2571d5eb1f66180cf8eebc281d7a41bd openssh-askpass-gnome-3.9p1-8.RHEL4.20.ppc.rpm 195d880c6af6314c807fd74249bc494c openssh-clients-3.9p1-8.RHEL4.20.ppc.rpm b8dfde972ad2d579e8ded57589cdf4f7 openssh-debuginfo-3.9p1-8.RHEL4.20.ppc.rpm 5bac6e49005be5b599254ab40e6582f1 openssh-server-3.9p1-8.RHEL4.20.ppc.rpm
s390: 7f2a4d71dde9957902770b5a8cbebb98 openssh-3.9p1-8.RHEL4.20.s390.rpm 6a768d4d2fb313e8e9536854f8980cff openssh-askpass-3.9p1-8.RHEL4.20.s390.rpm e0eed1c1b158d2b9f4265931ddfec2df openssh-askpass-gnome-3.9p1-8.RHEL4.20.s390.rpm d776bccdb065c52fee0820c2452e7909 openssh-clients-3.9p1-8.RHEL4.20.s390.rpm 1fcd5df3d202ceb6ddbf2decade7bd18 openssh-debuginfo-3.9p1-8.RHEL4.20.s390.rpm 05f4d043e3fd7993e041ac8af1954ffd openssh-server-3.9p1-8.RHEL4.20.s390.rpm
s390x: ee4dd7366a973d0cc074397ab44b3d36 openssh-3.9p1-8.RHEL4.20.s390x.rpm e521ced488fc72105e1591653855cfa0 openssh-askpass-3.9p1-8.RHEL4.20.s390x.rpm b3099fded8c796a4b7a26fc9918f8694 openssh-askpass-gnome-3.9p1-8.RHEL4.20.s390x.rpm 7b3894c6220efb08cd42e2ba41b97c24 openssh-clients-3.9p1-8.RHEL4.20.s390x.rpm 71b619d3ae4411c7ca6f557b342165e1 openssh-debuginfo-3.9p1-8.RHEL4.20.s390x.rpm 612e6fa71dd9d0b4a0abb84af6ad0e0d openssh-server-3.9p1-8.RHEL4.20.s390x.rpm
x86_64: 61cd0299d5413094af7970856f7fffc8 openssh-3.9p1-8.RHEL4.20.x86_64.rpm 88464fef4b7393f7f081dc0c734bcd53 openssh-askpass-3.9p1-8.RHEL4.20.x86_64.rpm 198d98b530ce9fbfe6dd6b3d3b38712c openssh-askpass-gnome-3.9p1-8.RHEL4.20.x86_64.rpm 1c3c86136815400a0713187d9f55315b openssh-clients-3.9p1-8.RHEL4.20.x86_64.rpm b242035b20927623270bb32fe531b5bd openssh-debuginfo-3.9p1-8.RHEL4.20.x86_64.rpm e6b172814bfc7402996bf498a8f37634 openssh-server-3.9p1-8.RHEL4.20.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
SRPMS: openssh-3.9p1-8.RHEL4.20.src.rpm 73cd43ad99e6b5eb626914bb65f11d70 openssh-3.9p1-8.RHEL4.20.src.rpm
i386: 355fb0d34d1207f6629f886f8cf3e6c4 openssh-3.9p1-8.RHEL4.20.i386.rpm 5b062f94d91ed8418c45745d8b285bd4 openssh-askpass-3.9p1-8.RHEL4.20.i386.rpm 4c13962301e5f93492fcb02b7f01a7b1 openssh-askpass-gnome-3.9p1-8.RHEL4.20.i386.rpm 029fa6c52dec14626a1e443caecc2300 openssh-clients-3.9p1-8.RHEL4.20.i386.rpm f022d0b8cf19f1118fc7521142e7e71c openssh-debuginfo-3.9p1-8.RHEL4.20.i386.rpm 74c1c9b1293e8e46ecaf46db181d3a1b openssh-server-3.9p1-8.RHEL4.20.i386.rpm
x86_64: 61cd0299d5413094af7970856f7fffc8 openssh-3.9p1-8.RHEL4.20.x86_64.rpm 88464fef4b7393f7f081dc0c734bcd53 openssh-askpass-3.9p1-8.RHEL4.20.x86_64.rpm 198d98b530ce9fbfe6dd6b3d3b38712c openssh-askpass-gnome-3.9p1-8.RHEL4.20.x86_64.rpm 1c3c86136815400a0713187d9f55315b openssh-clients-3.9p1-8.RHEL4.20.x86_64.rpm b242035b20927623270bb32fe531b5bd openssh-debuginfo-3.9p1-8.RHEL4.20.x86_64.rpm e6b172814bfc7402996bf498a8f37634 openssh-server-3.9p1-8.RHEL4.20.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
SRPMS: openssh-3.9p1-8.RHEL4.20.src.rpm 73cd43ad99e6b5eb626914bb65f11d70 openssh-3.9p1-8.RHEL4.20.src.rpm
i386: 355fb0d34d1207f6629f886f8cf3e6c4 openssh-3.9p1-8.RHEL4.20.i386.rpm 5b062f94d91ed8418c45745d8b285bd4 openssh-askpass-3.9p1-8.RHEL4.20.i386.rpm 4c13962301e5f93492fcb02b7f01a7b1 openssh-askpass-gnome-3.9p1-8.RHEL4.20.i386.rpm 029fa6c52dec14626a1e443caecc2300 openssh-clients-3.9p1-8.RHEL4.20.i386.rpm f022d0b8cf19f1118fc7521142e7e71c openssh-debuginfo-3.9p1-8.RHEL4.20.i386.rpm 74c1c9b1293e8e46ecaf46db181d3a1b openssh-server-3.9p1-8.RHEL4.20.i386.rpm
ia64: 063a012cb911cad11e1c6e1f700e46ab openssh-3.9p1-8.RHEL4.20.ia64.rpm 67a3c8ab28bdcefe7b2fb957c933b996 openssh-askpass-3.9p1-8.RHEL4.20.ia64.rpm ce81cfbef39e88997fd9084f04f46f26 openssh-askpass-gnome-3.9p1-8.RHEL4.20.ia64.rpm c7bd82bac6e899e197ce59d4dc061d07 openssh-clients-3.9p1-8.RHEL4.20.ia64.rpm 8bca6d06228a0250582fbb224e14f46b openssh-debuginfo-3.9p1-8.RHEL4.20.ia64.rpm 9110321bf599bf3f29eaccaa32b7ce1d openssh-server-3.9p1-8.RHEL4.20.ia64.rpm
x86_64: 61cd0299d5413094af7970856f7fffc8 openssh-3.9p1-8.RHEL4.20.x86_64.rpm 88464fef4b7393f7f081dc0c734bcd53 openssh-askpass-3.9p1-8.RHEL4.20.x86_64.rpm 198d98b530ce9fbfe6dd6b3d3b38712c openssh-askpass-gnome-3.9p1-8.RHEL4.20.x86_64.rpm 1c3c86136815400a0713187d9f55315b openssh-clients-3.9p1-8.RHEL4.20.x86_64.rpm b242035b20927623270bb32fe531b5bd openssh-debuginfo-3.9p1-8.RHEL4.20.x86_64.rpm e6b172814bfc7402996bf498a8f37634 openssh-server-3.9p1-8.RHEL4.20.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
SRPMS: openssh-3.9p1-8.RHEL4.20.src.rpm 73cd43ad99e6b5eb626914bb65f11d70 openssh-3.9p1-8.RHEL4.20.src.rpm
i386: 355fb0d34d1207f6629f886f8cf3e6c4 openssh-3.9p1-8.RHEL4.20.i386.rpm 5b062f94d91ed8418c45745d8b285bd4 openssh-askpass-3.9p1-8.RHEL4.20.i386.rpm 4c13962301e5f93492fcb02b7f01a7b1 openssh-askpass-gnome-3.9p1-8.RHEL4.20.i386.rpm 029fa6c52dec14626a1e443caecc2300 openssh-clients-3.9p1-8.RHEL4.20.i386.rpm f022d0b8cf19f1118fc7521142e7e71c openssh-debuginfo-3.9p1-8.RHEL4.20.i386.rpm 74c1c9b1293e8e46ecaf46db181d3a1b openssh-server-3.9p1-8.RHEL4.20.i386.rpm
ia64: 063a012cb911cad11e1c6e1f700e46ab openssh-3.9p1-8.RHEL4.20.ia64.rpm 67a3c8ab28bdcefe7b2fb957c933b996 openssh-askpass-3.9p1-8.RHEL4.20.ia64.rpm ce81cfbef39e88997fd9084f04f46f26 openssh-askpass-gnome-3.9p1-8.RHEL4.20.ia64.rpm c7bd82bac6e899e197ce59d4dc061d07 openssh-clients-3.9p1-8.RHEL4.20.ia64.rpm 8bca6d06228a0250582fbb224e14f46b openssh-debuginfo-3.9p1-8.RHEL4.20.ia64.rpm 9110321bf599bf3f29eaccaa32b7ce1d openssh-server-3.9p1-8.RHEL4.20.ia64.rpm
x86_64: 61cd0299d5413094af7970856f7fffc8 openssh-3.9p1-8.RHEL4.20.x86_64.rpm 88464fef4b7393f7f081dc0c734bcd53 openssh-askpass-3.9p1-8.RHEL4.20.x86_64.rpm 198d98b530ce9fbfe6dd6b3d3b38712c openssh-askpass-gnome-3.9p1-8.RHEL4.20.x86_64.rpm 1c3c86136815400a0713187d9f55315b openssh-clients-3.9p1-8.RHEL4.20.x86_64.rpm b242035b20927623270bb32fe531b5bd openssh-debuginfo-3.9p1-8.RHEL4.20.x86_64.rpm e6b172814bfc7402996bf498a8f37634 openssh-server-3.9p1-8.RHEL4.20.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2666 http://www.redhat.com/security/updates/classification/#low
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact details at https://www.redhat.com/security/team/contact/
Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFGN369XlSAg2UNWIIRAhbsAJ9LBYD/KePZGPmhqMABL+TiNcNM1wCeOsQ+ k93E2M32aMPbUmLEi3bQVSE= =xO6S -----END PGP SIGNATURE-----
-- Enterprise-watch-list mailing list Enterprise-watch-list@redhat.com https://www.redhat.com/mailman/listinfo/enterprise-watch-list
|
|
|
|