| |||||||||||||
Eridani alert ERISA-2002:026 (openssh)
The original mailing seems to have got lost somewhere. Probably due to my ISP's recent routing issues. -- Michael "Soruk" McConnell http://www.eridani.co.uk Eridani Linux -- Now including Cygwin amongst the CDs available Email: linux@eridani.co.uk -- Also Debian, Slackware, Mandrake and more... ---------- Forwarded message ---------- Date: Wed, 26 Jun 2002 18:02:02 +0100 (BST) From: Eridani Star System <linux@eridani.co.uk> To: eridani-announce@eridani.co.uk Subject: ERISA-2002:026 - openssh ========================================================================= ERIDANI LINUX - SECURITY ANNOUNCEMENT ========================================================================= Package: openssh Summary: Input validation error can allow privilege escalation Date: 2002-06-26 ID: ERISA-2002:026 ========================================================================= Problem description: All versions of OpenSSH's sshd between 2.9.9 and 3.3 contain an input validation error that can result in an integer overflow and privilege escalation. Although OpenSSH 2.9 and earlier are not affected upgrading to OpenSSH 3.4 is recommended, because OpenSSH 3.4 adds checks for a class of potential bugs. These packages come with compression disabled in the config file, due to privilege separation and compression not working together on 2.2.x kernels. ------------------------------------------------------------------------- Updated packages: 77743c94d0c4e3ce7aecde5fd1d4ad30 openssh-3.4p1-1.src.rpm e1d5c1885d32bc9e86130f507563ec1e openssh-3.4p1-1.i386.rpm 2f4304b804571b0aac6fc44083778721 openssh-askpass-3.4p1-1.i386.rpm a0e220a342bb51239e412a3c4fd64f3d openssh-askpass-gnome-3.4p1-1.i386.rpm c440f4662b662a9aba6fc534226fd531 openssh-clients-3.4p1-1.i386.rpm f053be2c647d7530a70dc49d26bafafb openssh-server-3.4p1-1.i386.rpm ------------------------------------------------------------------------- References: http://lwn.net/Articles/3531/ ========================================================================= Packages available from ftp://ftp.eridani.co.uk/pub/Aeryn/ or by HTTP from http://ftp.eridani.co.uk/ Packages are signed with our GNU GPG key, also on our FTP site. Users of releases of Eridani Linux prior to 6.3 are advised to download the source RPM and rebuild for their system. Copyright (C)2002 Eridani Star System -- Michael "Soruk" McConnell http://www.eridani.co.uk Eridani Linux -- The Most Up-to-Date Red Hat-based Linux CDROMs Available Email: linux@eridani.co.uk -- Also Debian, Slackware, Mandrake and more... (Log in to post comments)
|
|||||||||||||