drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in Dropbear SSH
Name: |
Mehrere Probleme in Dropbear SSH |
|
ID: |
openSUSE-SU-2016:1917-1 |
|
Distribution: |
SUSE |
|
Plattformen: |
openSUSE 13.1 |
|
Datum: |
So, 31. Juli 2016, 21:52 |
|
Referenzen: |
Keine Angabe |
|
Applikationen: |
Dropbear SSH |
|
Originalnachricht |
openSUSE Security Update: Security update for dropbear ______________________________________________________________________________
Announcement ID: openSUSE-SU-2016:1917-1 Rating: critical References: #990363 Affected Products: openSUSE 13.1 ______________________________________________________________________________
An update that contains security fixes can now be installed.
Description:
This update for dropbear fixes four security issues (bnc#990363):
- A format string injection vulnerability allowed remotes attacker to run arbitrary code as root if specific usernames including "%" symbols could be created on the target system. If a dbclient user can control usernames or host arguments, or untrusted input is processed, potentially arbitrary code could have been executed as the dbclient user. - When importing malicious OpenSSH key files via dropbearconvert, arbitrary code could have been executed as the local dropbearconvert user - If particular -m or -c arguments were provided, as used in scripts, dbclient could have executed arbitrary code - dbclient or dropbear server could have exposed process memory to the running user if compiled with DEBUG_TRACE and running with -v
Dropbear was updated to the upstream 2016.74 release, including fixes for the following upstream issues:
- Port forwarding failure when connecting to domains that have both IPv4 and IPv6 addresses - 100% CPU use while waiting for rekey to complete - Fix crash when fallback initshells() is used scp failing when the local user doesn't exist
The following upstream improvements are included:
- Support syslog in dbclient, option -o usesyslog=yes - Kill a proxycommand when dbclient exits - Option to exit when a TCP forward fails - Allow specifying commands eg "dropbearmulti dbclient ..." instead of symlinks
Patch Instructions:
To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product:
- openSUSE 13.1:
zypper in -t patch 2016-918=1
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 13.1 (i586 x86_64):
dropbear-2016.74-2.10.1 dropbear-debuginfo-2016.74-2.10.1 dropbear-debugsource-2016.74-2.10.1
References:
https://bugzilla.suse.com/990363
-- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security-announce+help@opensuse.org
|
|
|
|