Published:
23 September 2003
Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2003.0680 -- OpenSSH Security Advisory Portable OpenSSH versions 3.7p1 and 3.7.1p1 contain multiple vulnerabilities in the new PAM code 24 September 2003 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Portable OpenSSH versions 3.7p1 and 3.7.1p1 Publisher: OpenBSD Impact: Root Compromise Access Required: Remote Comment: The necessary conditions (often enabled by default) are required to be at risk: o PAM Authentication enabled. o Protocol version 1 enabled. o ChallengeResponse enabled. The OpenSSH advisory can be found at: http://www.openssh.com/txt/sshpam.adv - --------------------------BEGIN INCLUDED TEXT-------------------- Portable OpenSSH 3.7.1p2 has just been released. It will be available from the mirrors listed at http://www.openssh.com/portable.html shortly. Please note that this is a release to address issues in the portable version only. The items mentioned below do not affect the OpenBSD version. OpenSSH is a 100% complete SSH protocol version 1.3, 1.5 and 2.0 implementation and includes sftp client and server support. We would like to thank the OpenSSH community for their continued support to the project, especially those who contributed source and bought T-shirts or posters. We have a new design of T-shirt available, more info on http://www.openbsd.org/tshirts.html#18 For international orders use http://https.openbsd.org/cgi-bin/order and for European orders, use http://https.openbsd.org/cgi-bin/order.eu Security Changes:Portable OpenSSH 3.7.1p2 has just been released. It will be available from the mirrors listed at http://www.openssh.com/portable.html shortly. Please note that this is a release to address issues in the portable version only. The items mentioned below do not affect the OpenBSD version. OpenSSH is a 100% complete SSH protocol version 1.3, 1.5 and 2.0 implementation and includes sftp client and server support. We would like to thank the OpenSSH community for their continued support to the project, especially those who contributed source and bought T-shirts or posters. We have a new design of T-shirt available, more info on http://www.openbsd.org/tshirts.html#18 For international orders use http://https.openbsd.org/cgi-bin/order and for European orders, use http://https.openbsd.org/cgi-bin/order.eu Security Changes: ================= Portable OpenSSH version 3.7p1 and 3.7.1p1 contain multiple vulnerabilities in the new PAM authentication code. At least one of these bugs is remotely exploitable (under a non-standard configuration, with privsep disabled). OpenSSH 3.7.1p2 fixes these bugs. Please note that these bugs do not exist in OpenBSD's releases of OpenSSH. Changes since OpenSSH 3.7.1p1: ============================== * This release disables PAM by default. To enable it, set "UsePAM yes" in sshd_config. Due to complexity, inconsistencies in the specification and differences between vendors' PAM implementations we recommend that PAM be left disabled in sshd_config unless there is a need for its use. Sites using only public key or simple password authentication usually have little need to enable PAM support. * This release now requires zlib 1.1.4 to build correctly. Previous versions have security problems. * Fix compilation for versions of OpenSSL before 0.9.6. Some cipher modes are not supported for older OpenSSL versions. * Fix compilation problems on systems with a missing or lacking inet_ntoa() function. * Workaround problems related to unimplemented or broken setresuid/setreuid functions on several platforms. * Fix compilation on older OpenBSD systems. * Fix handling of password-less authentication (PermitEmptyPasswords=yes) that has not worked since the 3.7p1 release. Checksums: ========== - - MD5 (openssh-3.7.1p2.tar.gz) = 61cf5b059938718308836d00f6764a94 Reporting Bugs: =============== - - please read http://www.openssh.com/report.html and http://bugzilla.mindrot.org/ OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt, Kevin Steves, Damien Miller, Ben Lindstrom, Darren Tucker and Tim Rice. ================= Portable OpenSSH version 3.7p1 and 3.7.1p1 contain multiple vulnerabilities in the new PAM authentication code. At least one of these bugs is remotely exploitable (under a non-standard configuration, with privsep disabled). OpenSSH 3.7.1p2 fixes these bugs. Please note that these bugs do not exist in OpenBSD's releases of OpenSSH. Changes since OpenSSH 3.7.1p1: ============================== * This release disables PAM by default. To enable it, set "UsePAM yes" in sshd_config. Due to complexity, inconsistencies in the specification and differences between vendors' PAM implementations we recommend that PAM be left disabled in sshd_config unless there is a need for its use. Sites using only public key or simple password authentication usually have little need to enable PAM support. * This release now requires zlib 1.1.4 to build correctly. Previous versions have security problems. * Fix compilation for versions of OpenSSL before 0.9.6. Some cipher modes are not supported for older OpenSSL versions. * Fix compilation problems on systems with a missing or lacking inet_ntoa() function. * Workaround problems related to unimplemented or broken setresuid/setreuid functions on several platforms. * Fix compilation on older OpenBSD systems. * Fix handling of password-less authentication (PermitEmptyPasswords=yes) that has not worked since the 3.7p1 release. Checksums: ========== - - MD5 (openssh-3.7.1p2.tar.gz) = 61cf5b059938718308836d00f6764a94 Reporting Bugs: =============== - - please read http://www.openssh.com/report.html and http://bugzilla.mindrot.org/ OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt, Kevin Steves, Damien Miller, Ben Lindstrom, Darren Tucker and Tim Rice. - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 If you believe that your computer system has been compromised or attacked in any way, we encourage you to let us know by completing the secure National IT Incident Reporting Form at: http://www.auscert.org.au/render.html?it=3192 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBP3EBtyh9+71yA2DNAQEIGAP/a+sQoxCsUUitRyddxtWaHIOSeftzrVQI rMygKLORh3Xg+a50xAFYoc9Yxp9lXtH6QZHRBW9vPYiN13KUBe5TUtysOFHpCT7/ AEwx4fZkyICJomgzbhZlN6Sx4bXLW4cAPZenHU1jfFGp32KyQ9H+VaMXAvzlGbsO z9Od/JotaOw= =lZNv -----END PGP SIGNATURE-----