Login
Newsletter
Werbung

Sicherheit: Unautorisierte Verwendung von X-Weiterleitungen in openssh
Aktuelle Meldungen Distributionen
Name: Unautorisierte Verwendung von X-Weiterleitungen in openssh
ID: MDVSA-2008:078
Distribution: Mandriva
Plattformen: Mandriva Corporate 3.0, Mandriva Multi Network Firewall 2.0, Mandriva Corporate 4.0, Mandriva 2007.0, Mandriva 2007.1, Mandriva 2008.0
Datum: Do, 27. März 2008, 02:41
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1483
Applikationen: Portable OpenSSH

Originalnachricht

This is a multi-part message in MIME format...

------------=_1206582095-11275-1768


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2008:078
http://www.mandriva.com/security/
_______________________________________________________________________

Package : openssh
Date : March 26, 2008
Affected: 2007.0, 2007.1, 2008.0, Corporate 3.0, Corporate 4.0,
Multi Network Firewall 2.0
_______________________________________________________________________

Problem Description:

OpenSSH allows local users to hijack forwarded X connections by causing
ssh to set DISPLAY to :10, even when another process is listening on
the associated port.

The updated packages have been patched to prevent this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1483
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2007.0:
1cdb7c7b2ef0e3a98ed969c4cc176c37
2007.0/i586/openssh-4.5p1-0.3mdv2007.0.i586.rpm
0fe8702c067054b0c375bbad1efa2b30
2007.0/i586/openssh-askpass-4.5p1-0.3mdv2007.0.i586.rpm
134caea38014a9c13e3b05b6377a4b22
2007.0/i586/openssh-askpass-common-4.5p1-0.3mdv2007.0.i586.rpm
ea641b9578d27f562a1d688d8694448f
2007.0/i586/openssh-askpass-gnome-4.5p1-0.3mdv2007.0.i586.rpm
4e163bf66feedeaa93d640190c64273a
2007.0/i586/openssh-clients-4.5p1-0.3mdv2007.0.i586.rpm
4c1619ecbf0f927a4cc13cde8ad4e905
2007.0/i586/openssh-server-4.5p1-0.3mdv2007.0.i586.rpm
aa30bb74824eb2fe90133c7d07c8dab9
2007.0/SRPMS/openssh-4.5p1-0.3mdv2007.0.src.rpm

Mandriva Linux 2007.0/X86_64:
553a1d1a68afb3e6dd2cc92650810e6b
2007.0/x86_64/openssh-4.5p1-0.3mdv2007.0.x86_64.rpm
b4ecf9307bb4262b39462e333062bbfa
2007.0/x86_64/openssh-askpass-4.5p1-0.3mdv2007.0.x86_64.rpm
7b8f442b651db9093c2984ce181eecdb
2007.0/x86_64/openssh-askpass-common-4.5p1-0.3mdv2007.0.x86_64.rpm
3ce5a4a378f8066896cd7ca573adc91b
2007.0/x86_64/openssh-askpass-gnome-4.5p1-0.3mdv2007.0.x86_64.rpm
266dedc3bd7ced35c23a90fa68c66863
2007.0/x86_64/openssh-clients-4.5p1-0.3mdv2007.0.x86_64.rpm
80565ee42635497514dd55a038e19111
2007.0/x86_64/openssh-server-4.5p1-0.3mdv2007.0.x86_64.rpm
aa30bb74824eb2fe90133c7d07c8dab9
2007.0/SRPMS/openssh-4.5p1-0.3mdv2007.0.src.rpm

Mandriva Linux 2007.1:
2cce377c3c1ed3ab206c3d7422ec3acb
2007.1/i586/openssh-4.6p1-1.2mdv2007.1.i586.rpm
b5ee72f9edd2b85fd63447e678af5cb6
2007.1/i586/openssh-askpass-4.6p1-1.2mdv2007.1.i586.rpm
d987a90109da19e121c8d5699ea451df
2007.1/i586/openssh-askpass-common-4.6p1-1.2mdv2007.1.i586.rpm
02d2e8e07a1aaa07c1379fd8b451daac
2007.1/i586/openssh-askpass-gnome-4.6p1-1.2mdv2007.1.i586.rpm
b4162da613394bdd7c53b0469d59092a
2007.1/i586/openssh-clients-4.6p1-1.2mdv2007.1.i586.rpm
53f970e4c4d8630ce06017e74b4a8117
2007.1/i586/openssh-server-4.6p1-1.2mdv2007.1.i586.rpm
0e9a0fae3361d887239b02f56f966e70
2007.1/SRPMS/openssh-4.6p1-1.2mdv2007.1.src.rpm

Mandriva Linux 2007.1/X86_64:
c68c6170ec716ec6eb9748ae3b9966de
2007.1/x86_64/openssh-4.6p1-1.2mdv2007.1.x86_64.rpm
533976030cc8915c2524744189d36252
2007.1/x86_64/openssh-askpass-4.6p1-1.2mdv2007.1.x86_64.rpm
76969355a7adf93a742761a30e0e9f30
2007.1/x86_64/openssh-askpass-common-4.6p1-1.2mdv2007.1.x86_64.rpm
54cf4b7fadbbb52b241b38ad8298c75b
2007.1/x86_64/openssh-askpass-gnome-4.6p1-1.2mdv2007.1.x86_64.rpm
560bd1f969a341204ed65e0b4ec974e2
2007.1/x86_64/openssh-clients-4.6p1-1.2mdv2007.1.x86_64.rpm
cc5df054e5ee3e26cb40708ea7d20f1b
2007.1/x86_64/openssh-server-4.6p1-1.2mdv2007.1.x86_64.rpm
0e9a0fae3361d887239b02f56f966e70
2007.1/SRPMS/openssh-4.6p1-1.2mdv2007.1.src.rpm

Mandriva Linux 2008.0:
2111c70d431c328c7077ffadf1ff1611
2008.0/i586/openssh-4.7p1-2.2mdv2008.0.i586.rpm
abd7791007806997f15568f4bf5ad480
2008.0/i586/openssh-askpass-4.7p1-2.2mdv2008.0.i586.rpm
f2d471277db50b95888b3685c65786dc
2008.0/i586/openssh-askpass-common-4.7p1-2.2mdv2008.0.i586.rpm
fa556ac82136323f2d7bce7bc2ebdc4d
2008.0/i586/openssh-askpass-gnome-4.7p1-2.2mdv2008.0.i586.rpm
9390b79a551600c984f568c4a61e0c36
2008.0/i586/openssh-clients-4.7p1-2.2mdv2008.0.i586.rpm
7d19398174cd1b98811720e4ac2bb6ea
2008.0/i586/openssh-server-4.7p1-2.2mdv2008.0.i586.rpm
a4a38dc3d02ada40d15c3c82a8714431
2008.0/SRPMS/openssh-4.7p1-2.2mdv2008.0.src.rpm

Mandriva Linux 2008.0/X86_64:
ce637761cdca3a2885d71008d68ad5ce
2008.0/x86_64/openssh-4.7p1-2.2mdv2008.0.x86_64.rpm
dd96178f7bbafc7fa4c6165f027424f7
2008.0/x86_64/openssh-askpass-4.7p1-2.2mdv2008.0.x86_64.rpm
e59c6e5cf414167b934b556b2b733182
2008.0/x86_64/openssh-askpass-common-4.7p1-2.2mdv2008.0.x86_64.rpm
c06a24dbbfcc82b820641e1f6215cf7e
2008.0/x86_64/openssh-askpass-gnome-4.7p1-2.2mdv2008.0.x86_64.rpm
b1612dfbc98eba2d2395c8275080b3b6
2008.0/x86_64/openssh-clients-4.7p1-2.2mdv2008.0.x86_64.rpm
8b36887467cb04a1c6549a7a89d24d5d
2008.0/x86_64/openssh-server-4.7p1-2.2mdv2008.0.x86_64.rpm
a4a38dc3d02ada40d15c3c82a8714431
2008.0/SRPMS/openssh-4.7p1-2.2mdv2008.0.src.rpm

Corporate 3.0:
bd39164a0885b1048a1bad7ee36e4b5c
corporate/3.0/i586/openssh-4.3p1-0.5.C30mdk.i586.rpm
28d40b0131d01224e8302b09b701c241
corporate/3.0/i586/openssh-askpass-4.3p1-0.5.C30mdk.i586.rpm
b0ecd0e810a3688e8c325e2e9490ac19
corporate/3.0/i586/openssh-askpass-gnome-4.3p1-0.5.C30mdk.i586.rpm
73f0a5ed87d85459542d0daf91afc342
corporate/3.0/i586/openssh-clients-4.3p1-0.5.C30mdk.i586.rpm
7598a2dcef9d65274ceef4b05daf6f6c
corporate/3.0/i586/openssh-server-4.3p1-0.5.C30mdk.i586.rpm
47a7c143a1f59df502d679fad706407b
corporate/3.0/SRPMS/openssh-4.3p1-0.5.C30mdk.src.rpm

Corporate 3.0/X86_64:
9741d292d7ab4e9897144b2e9e241028
corporate/3.0/x86_64/openssh-4.3p1-0.5.C30mdk.x86_64.rpm
acfadda7a360c60928ff3cbc0396b286
corporate/3.0/x86_64/openssh-askpass-4.3p1-0.5.C30mdk.x86_64.rpm
a40bfc1509425d8d4873f09ba4655a6f
corporate/3.0/x86_64/openssh-askpass-gnome-4.3p1-0.5.C30mdk.x86_64.rpm
2045a78a038012bdf8d3f008dd929848
corporate/3.0/x86_64/openssh-clients-4.3p1-0.5.C30mdk.x86_64.rpm
63f2dd8d94e1386a0dd40584cdb331ec
corporate/3.0/x86_64/openssh-server-4.3p1-0.5.C30mdk.x86_64.rpm
47a7c143a1f59df502d679fad706407b
corporate/3.0/SRPMS/openssh-4.3p1-0.5.C30mdk.src.rpm

Corporate 4.0:
90a82a41e96edc3a906415fd8752d4ae
corporate/4.0/i586/openssh-4.3p1-0.6.20060mlcs4.i586.rpm
ccc5e86dd030d38ea68e20fc94f2f09d
corporate/4.0/i586/openssh-askpass-4.3p1-0.6.20060mlcs4.i586.rpm
98f6b7de70978476bc88649dd1d7aee5
corporate/4.0/i586/openssh-askpass-gnome-4.3p1-0.6.20060mlcs4.i586.rpm
e9ccaf3b3f2da24a319f0a8486bba6a6
corporate/4.0/i586/openssh-clients-4.3p1-0.6.20060mlcs4.i586.rpm
2a21febb787249e6640326faf776a47b
corporate/4.0/i586/openssh-server-4.3p1-0.6.20060mlcs4.i586.rpm
3c9380388adfa5ce11c469aba798fa50
corporate/4.0/SRPMS/openssh-4.3p1-0.6.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
75c4138df03cb7338e4f0fd00b11d089
corporate/4.0/x86_64/openssh-4.3p1-0.6.20060mlcs4.x86_64.rpm
ee15ff755b409b38d0ef5565d33f46a3
corporate/4.0/x86_64/openssh-askpass-4.3p1-0.6.20060mlcs4.x86_64.rpm
4fefe00577fc32dfc1b998dbf938086f
corporate/4.0/x86_64/openssh-askpass-gnome-4.3p1-0.6.20060mlcs4.x86_64.rpm
ae087298d947fa6042f9b0bb6ca4eb47
corporate/4.0/x86_64/openssh-clients-4.3p1-0.6.20060mlcs4.x86_64.rpm
eac093e98f64783eeefc12a4db6ec2c2
corporate/4.0/x86_64/openssh-server-4.3p1-0.6.20060mlcs4.x86_64.rpm
3c9380388adfa5ce11c469aba798fa50
corporate/4.0/SRPMS/openssh-4.3p1-0.6.20060mlcs4.src.rpm

Multi Network Firewall 2.0:
64edf29914476e979c84adc5126d146b
mnf/2.0/i586/openssh-4.3p1-0.5.M20mdk.i586.rpm
3852bab5554701da9d449c4a3be4c63b
mnf/2.0/i586/openssh-askpass-4.3p1-0.5.M20mdk.i586.rpm
3b2d30fbfd949cc0cb8854cc372eb0c1
mnf/2.0/i586/openssh-askpass-gnome-4.3p1-0.5.M20mdk.i586.rpm
1023e4044888cd2c60840328a0a94eb4
mnf/2.0/i586/openssh-clients-4.3p1-0.5.M20mdk.i586.rpm
6a9319816793ec07b1874c880599c316
mnf/2.0/i586/openssh-server-4.3p1-0.5.M20mdk.i586.rpm
3e888dc4c4879fcb9d834bac1b789405
mnf/2.0/SRPMS/openssh-4.3p1-0.5.M20mdk.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)

iD8DBQFH6s6BmqjQ0CJFipgRAv/DAKCChRGxX5CS6Shhn5MiT5mvechPmgCeNbMJ
a02Qog6Gy/e/vPp21tMQDbM=
=pdXy
-----END PGP SIGNATURE-----


------------=_1206582095-11275-1768
Content-Type: text/plain; name="message-footer.txt"
Content-Disposition: inline; filename="message-footer.txt"
Content-Transfer-Encoding: 8bit

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://www.mandrivastore.com
Join the Club : http://www.mandrivaclub.com
_______________________________________________________

------------=_1206582095-11275-1768--
Pro-Linux
Traut euch!
Neue Nachrichten
Werbung