A new update is available for Red Hat Enterprise Linux. Here the announcement:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Low: openssh security and bug fix update
Advisory ID: RHSA-2007:0257-02
Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0257.html
Issue date: 2007-05-01
Updated on: 2007-05-01
Product: Red Hat Enterprise Linux
Keywords: syslog buffer length IPv6 X11 forwarding
CVE Names: CVE-2005-2666
- ---------------------------------------------------------------------
1. Summary:
Updated openssh packages that fix a security issue and various bugs are now
available.
This update has been rated as having low security impact by the Red Hat
Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
3. Problem description:
OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. This
package includes the core files necessary for both the OpenSSH client and
server.
OpenSSH stores hostnames, IP addresses, and keys in plaintext in the
known_hosts file. A local attacker that has already compromised a user's
SSH account could use this information to generate a list of additional
targets that are likely to have the same password or key. (CVE-2005-2666)
The following bugs have also been fixed in this update:
* The ssh client could abort the running connection when the server
application generated a large output at once.
* When 'X11UseLocalhost' option was set to 'no' on systems with IPv6
networking enabled, the X11 forwarding socket listened only for IPv6
connections.
* When the privilege separation was enabled in /etc/ssh/sshd_config, some
log messages in the system log were duplicated and also had timestamps from
an incorrect timezone.
All users of openssh should upgrade to these updated packages, which
contain backported patches to correct these issues.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
5. Bug IDs fixed (http://bugzilla.redhat.com/):
162681 - CVE-2005-2666 openssh vulnerable to known_hosts address harvesting
184357 - buffer_append_space: alloc not supported Error
193710 - [PATCH] audit patch for openssh missing #include "loginrec.h" in auth.c
201594 - sshd does not create ipv4 listen socket for X11 forwarding
203671 - additional (time skewed) log entries in /var/log/secure since U4
6. RPMs required:
Red Hat Enterprise Linux AS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/openssh-3.9p1-8.RHEL4.20.src.rpm
73cd43ad99e6b5eb626914bb65f11d70 openssh-3.9p1-8.RHEL4.20.src.rpm
i386:
355fb0d34d1207f6629f886f8cf3e6c4 openssh-3.9p1-8.RHEL4.20.i386.rpm
5b062f94d91ed8418c45745d8b285bd4 openssh-askpass-3.9p1-8.RHEL4.20.i386.rpm
4c13962301e5f93492fcb02b7f01a7b1 openssh-askpass-gnome-3.9p1-8.RHEL4.20.i386.rpm
029fa6c52dec14626a1e443caecc2300 openssh-clients-3.9p1-8.RHEL4.20.i386.rpm
f022d0b8cf19f1118fc7521142e7e71c openssh-debuginfo-3.9p1-8.RHEL4.20.i386.rpm
74c1c9b1293e8e46ecaf46db181d3a1b openssh-server-3.9p1-8.RHEL4.20.i386.rpm
ia64:
063a012cb911cad11e1c6e1f700e46ab openssh-3.9p1-8.RHEL4.20.ia64.rpm
67a3c8ab28bdcefe7b2fb957c933b996 openssh-askpass-3.9p1-8.RHEL4.20.ia64.rpm
ce81cfbef39e88997fd9084f04f46f26 openssh-askpass-gnome-3.9p1-8.RHEL4.20.ia64.rpm
c7bd82bac6e899e197ce59d4dc061d07 openssh-clients-3.9p1-8.RHEL4.20.ia64.rpm
8bca6d06228a0250582fbb224e14f46b openssh-debuginfo-3.9p1-8.RHEL4.20.ia64.rpm
9110321bf599bf3f29eaccaa32b7ce1d openssh-server-3.9p1-8.RHEL4.20.ia64.rpm
ppc:
cac15ade9405e8ef47939842656b6f70 openssh-3.9p1-8.RHEL4.20.ppc.rpm
783a2f6121f3a7373e5f7d7048f95ecd openssh-askpass-3.9p1-8.RHEL4.20.ppc.rpm
2571d5eb1f66180cf8eebc281d7a41bd openssh-askpass-gnome-3.9p1-8.RHEL4.20.ppc.rpm
195d880c6af6314c807fd74249bc494c openssh-clients-3.9p1-8.RHEL4.20.ppc.rpm
b8dfde972ad2d579e8ded57589cdf4f7 openssh-debuginfo-3.9p1-8.RHEL4.20.ppc.rpm
5bac6e49005be5b599254ab40e6582f1 openssh-server-3.9p1-8.RHEL4.20.ppc.rpm
s390:
7f2a4d71dde9957902770b5a8cbebb98 openssh-3.9p1-8.RHEL4.20.s390.rpm
6a768d4d2fb313e8e9536854f8980cff openssh-askpass-3.9p1-8.RHEL4.20.s390.rpm
e0eed1c1b158d2b9f4265931ddfec2df openssh-askpass-gnome-3.9p1-8.RHEL4.20.s390.rpm
d776bccdb065c52fee0820c2452e7909 openssh-clients-3.9p1-8.RHEL4.20.s390.rpm
1fcd5df3d202ceb6ddbf2decade7bd18 openssh-debuginfo-3.9p1-8.RHEL4.20.s390.rpm
05f4d043e3fd7993e041ac8af1954ffd openssh-server-3.9p1-8.RHEL4.20.s390.rpm
s390x:
ee4dd7366a973d0cc074397ab44b3d36 openssh-3.9p1-8.RHEL4.20.s390x.rpm
e521ced488fc72105e1591653855cfa0 openssh-askpass-3.9p1-8.RHEL4.20.s390x.rpm
b3099fded8c796a4b7a26fc9918f8694 openssh-askpass-gnome-3.9p1-8.RHEL4.20.s390x.rpm
7b3894c6220efb08cd42e2ba41b97c24 openssh-clients-3.9p1-8.RHEL4.20.s390x.rpm
71b619d3ae4411c7ca6f557b342165e1 openssh-debuginfo-3.9p1-8.RHEL4.20.s390x.rpm
612e6fa71dd9d0b4a0abb84af6ad0e0d openssh-server-3.9p1-8.RHEL4.20.s390x.rpm
x86_64:
61cd0299d5413094af7970856f7fffc8 openssh-3.9p1-8.RHEL4.20.x86_64.rpm
88464fef4b7393f7f081dc0c734bcd53 openssh-askpass-3.9p1-8.RHEL4.20.x86_64.rpm
198d98b530ce9fbfe6dd6b3d3b38712c openssh-askpass-gnome-3.9p1-8.RHEL4.20.x86_64.rpm
1c3c86136815400a0713187d9f55315b openssh-clients-3.9p1-8.RHEL4.20.x86_64.rpm
b242035b20927623270bb32fe531b5bd openssh-debuginfo-3.9p1-8.RHEL4.20.x86_64.rpm
e6b172814bfc7402996bf498a8f37634 openssh-server-3.9p1-8.RHEL4.20.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/openssh-3.9p1-8.RHEL4.20.src.rpm
73cd43ad99e6b5eb626914bb65f11d70 openssh-3.9p1-8.RHEL4.20.src.rpm
i386:
355fb0d34d1207f6629f886f8cf3e6c4 openssh-3.9p1-8.RHEL4.20.i386.rpm
5b062f94d91ed8418c45745d8b285bd4 openssh-askpass-3.9p1-8.RHEL4.20.i386.rpm
4c13962301e5f93492fcb02b7f01a7b1 openssh-askpass-gnome-3.9p1-8.RHEL4.20.i386.rpm
029fa6c52dec14626a1e443caecc2300 openssh-clients-3.9p1-8.RHEL4.20.i386.rpm
f022d0b8cf19f1118fc7521142e7e71c openssh-debuginfo-3.9p1-8.RHEL4.20.i386.rpm
74c1c9b1293e8e46ecaf46db181d3a1b openssh-server-3.9p1-8.RHEL4.20.i386.rpm
x86_64:
61cd0299d5413094af7970856f7fffc8 openssh-3.9p1-8.RHEL4.20.x86_64.rpm
88464fef4b7393f7f081dc0c734bcd53 openssh-askpass-3.9p1-8.RHEL4.20.x86_64.rpm
198d98b530ce9fbfe6dd6b3d3b38712c openssh-askpass-gnome-3.9p1-8.RHEL4.20.x86_64.rpm
1c3c86136815400a0713187d9f55315b openssh-clients-3.9p1-8.RHEL4.20.x86_64.rpm
b242035b20927623270bb32fe531b5bd openssh-debuginfo-3.9p1-8.RHEL4.20.x86_64.rpm
e6b172814bfc7402996bf498a8f37634 openssh-server-3.9p1-8.RHEL4.20.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/openssh-3.9p1-8.RHEL4.20.src.rpm
73cd43ad99e6b5eb626914bb65f11d70 openssh-3.9p1-8.RHEL4.20.src.rpm
i386:
355fb0d34d1207f6629f886f8cf3e6c4 openssh-3.9p1-8.RHEL4.20.i386.rpm
5b062f94d91ed8418c45745d8b285bd4 openssh-askpass-3.9p1-8.RHEL4.20.i386.rpm
4c13962301e5f93492fcb02b7f01a7b1 openssh-askpass-gnome-3.9p1-8.RHEL4.20.i386.rpm
029fa6c52dec14626a1e443caecc2300 openssh-clients-3.9p1-8.RHEL4.20.i386.rpm
f022d0b8cf19f1118fc7521142e7e71c openssh-debuginfo-3.9p1-8.RHEL4.20.i386.rpm
74c1c9b1293e8e46ecaf46db181d3a1b openssh-server-3.9p1-8.RHEL4.20.i386.rpm
ia64:
063a012cb911cad11e1c6e1f700e46ab openssh-3.9p1-8.RHEL4.20.ia64.rpm
67a3c8ab28bdcefe7b2fb957c933b996 openssh-askpass-3.9p1-8.RHEL4.20.ia64.rpm
ce81cfbef39e88997fd9084f04f46f26 openssh-askpass-gnome-3.9p1-8.RHEL4.20.ia64.rpm
c7bd82bac6e899e197ce59d4dc061d07 openssh-clients-3.9p1-8.RHEL4.20.ia64.rpm
8bca6d06228a0250582fbb224e14f46b openssh-debuginfo-3.9p1-8.RHEL4.20.ia64.rpm
9110321bf599bf3f29eaccaa32b7ce1d openssh-server-3.9p1-8.RHEL4.20.ia64.rpm
x86_64:
61cd0299d5413094af7970856f7fffc8 openssh-3.9p1-8.RHEL4.20.x86_64.rpm
88464fef4b7393f7f081dc0c734bcd53 openssh-askpass-3.9p1-8.RHEL4.20.x86_64.rpm
198d98b530ce9fbfe6dd6b3d3b38712c openssh-askpass-gnome-3.9p1-8.RHEL4.20.x86_64.rpm
1c3c86136815400a0713187d9f55315b openssh-clients-3.9p1-8.RHEL4.20.x86_64.rpm
b242035b20927623270bb32fe531b5bd openssh-debuginfo-3.9p1-8.RHEL4.20.x86_64.rpm
e6b172814bfc7402996bf498a8f37634 openssh-server-3.9p1-8.RHEL4.20.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/openssh-3.9p1-8.RHEL4.20.src.rpm
73cd43ad99e6b5eb626914bb65f11d70 openssh-3.9p1-8.RHEL4.20.src.rpm
i386:
355fb0d34d1207f6629f886f8cf3e6c4 openssh-3.9p1-8.RHEL4.20.i386.rpm
5b062f94d91ed8418c45745d8b285bd4 openssh-askpass-3.9p1-8.RHEL4.20.i386.rpm
4c13962301e5f93492fcb02b7f01a7b1 openssh-askpass-gnome-3.9p1-8.RHEL4.20.i386.rpm
029fa6c52dec14626a1e443caecc2300 openssh-clients-3.9p1-8.RHEL4.20.i386.rpm
f022d0b8cf19f1118fc7521142e7e71c openssh-debuginfo-3.9p1-8.RHEL4.20.i386.rpm
74c1c9b1293e8e46ecaf46db181d3a1b openssh-server-3.9p1-8.RHEL4.20.i386.rpm
ia64:
063a012cb911cad11e1c6e1f700e46ab openssh-3.9p1-8.RHEL4.20.ia64.rpm
67a3c8ab28bdcefe7b2fb957c933b996 openssh-askpass-3.9p1-8.RHEL4.20.ia64.rpm
ce81cfbef39e88997fd9084f04f46f26 openssh-askpass-gnome-3.9p1-8.RHEL4.20.ia64.rpm
c7bd82bac6e899e197ce59d4dc061d07 openssh-clients-3.9p1-8.RHEL4.20.ia64.rpm
8bca6d06228a0250582fbb224e14f46b openssh-debuginfo-3.9p1-8.RHEL4.20.ia64.rpm
9110321bf599bf3f29eaccaa32b7ce1d openssh-server-3.9p1-8.RHEL4.20.ia64.rpm
x86_64:
61cd0299d5413094af7970856f7fffc8 openssh-3.9p1-8.RHEL4.20.x86_64.rpm
88464fef4b7393f7f081dc0c734bcd53 openssh-askpass-3.9p1-8.RHEL4.20.x86_64.rpm
198d98b530ce9fbfe6dd6b3d3b38712c openssh-askpass-gnome-3.9p1-8.RHEL4.20.x86_64.rpm
1c3c86136815400a0713187d9f55315b openssh-clients-3.9p1-8.RHEL4.20.x86_64.rpm
b242035b20927623270bb32fe531b5bd openssh-debuginfo-3.9p1-8.RHEL4.20.x86_64.rpm
e6b172814bfc7402996bf498a8f37634 openssh-server-3.9p1-8.RHEL4.20.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2666
http://www.redhat.com/security/updates/classification/#low
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2007 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFGN369XlSAg2UNWIIRAhbsAJ9LBYD/KePZGPmhqMABL+TiNcNM1wCeOsQ+
k93E2M32aMPbUmLEi3bQVSE=
=xO6S
-----END PGP SIGNATURE-----
