Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2005.0775 -- RHSA-2005:527-01
Moderate: openssh security update
6 October 2005
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: openssh
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux Desktop 4
Red Hat Enterprise Linux AS/ES/WS 4
UNIX variants
Impact: Inappropriate Access
Access: Existing Account
CVE Names: CAN-2005-2798
Original Bulletin: https://rhn.redhat.com/errata/RHSA-2005-527.html
Comment: This advisory references vulnerabilities in products which run on
platforms other than Red Hat Linux. It is recommended that
administrators running openssh check for an updated version of
the software for their operating system.
This vulnerability is fixed in OpenSSH 4.2.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Moderate: openssh security update
Advisory ID: RHSA-2005:527-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-527.html
Issue date: 2005-10-05
Updated on: 2005-10-05
Product: Red Hat Enterprise Linux
CVE Names: CAN-2005-2798
- - ---------------------------------------------------------------------
1. Summary:
Updated openssh packages that fix a security issue, bugs, and add support
for recording login user IDs for audit are now available for Red Hat
Enterprise Linux 4.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
3. Problem description:
OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation.
An error in the way OpenSSH handled GSSAPI credential delegation was
discovered. OpenSSH as distributed with Red Hat Enterprise Linux 4 contains
support for GSSAPI user authentication, typically used for supporting
Kerberos. On OpenSSH installations which have GSSAPI enabled, this flaw
could allow a user who sucessfully authenticates using a method other than
GSSAPI to be delegated with GSSAPI credentials. The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the name CAN-2005-2798
to this issue.
Additionally, the following bugs have been addressed:
The ssh command incorrectly failed when it was issued by the root user with
a non-default group set.
The sshd daemon could fail to properly close the client connection if
multiple X clients were forwarded over the connection and the client
session exited.
The sshd daemon could bind only on the IPv6 address family for X forwarding
if the port on IPv4 address family was already bound. The X forwarding did
not work in such cases.
This update also adds support for recording login user IDs for the auditing
service. The user ID is attached to the audit records generated from the
user's session.
All users of openssh should upgrade to these updated packages, which
contain backported patches to resolve these issues.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
5. Bug IDs fixed (http://bugzilla.redhat.com/):
159331 - sshd update for new audit system
167444 - CAN-2005-2798 Improper GSSAPI credential delegation
6. RPMs required:
Red Hat Enterprise Linux AS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/openssh-3.9p1-8.RHEL4.9.src.rpm
2cbb0102ce3dc2c36c328819f8522bbc openssh-3.9p1-8.RHEL4.9.src.rpm
i386:
4a5add7335d6b6bcf9a202e45e782eee openssh-3.9p1-8.RHEL4.9.i386.rpm
77cc6d8b6be9c613f80cd7d52c9f91e3 openssh-askpass-3.9p1-8.RHEL4.9.i386.rpm
76c9ac8255dbc25184887dd93cfdb047 openssh-askpass-gnome-3.9p1-8.RHEL4.9.i386.rpm
45350fbd7c5356467ebfc2e2a7bfc55a openssh-clients-3.9p1-8.RHEL4.9.i386.rpm
32e69cc88f09f6785badd3b82fdccb31 openssh-server-3.9p1-8.RHEL4.9.i386.rpm
ia64:
f27d73d28c920358dcb434c3ed8489cf openssh-3.9p1-8.RHEL4.9.ia64.rpm
512632b31d333408cf2e05a3e567e16a openssh-askpass-3.9p1-8.RHEL4.9.ia64.rpm
6771aafbd50b0ead67418404cbd63711 openssh-askpass-gnome-3.9p1-8.RHEL4.9.ia64.rpm
0355970673f296c38ee961549665b64d openssh-clients-3.9p1-8.RHEL4.9.ia64.rpm
40fa71b924423c63af6215255cc21198 openssh-server-3.9p1-8.RHEL4.9.ia64.rpm
ppc:
e97bdb7f35c89a540f9c3204064c4b7e openssh-3.9p1-8.RHEL4.9.ppc.rpm
93dbfdb6052e0e4532d183b2dab9cb95 openssh-askpass-3.9p1-8.RHEL4.9.ppc.rpm
9e8e056a8677d7bdd45479be6c12f47d openssh-askpass-gnome-3.9p1-8.RHEL4.9.ppc.rpm
3af1774ffe5f61d7d0f89a1e0093bcff openssh-clients-3.9p1-8.RHEL4.9.ppc.rpm
3ec577e0d009372ed16343f8d7ddef4d openssh-server-3.9p1-8.RHEL4.9.ppc.rpm
s390:
dc7368330098bd6b02babcf62ae31773 openssh-3.9p1-8.RHEL4.9.s390.rpm
bbe31ee642601ed16e64aebca844adf3 openssh-askpass-3.9p1-8.RHEL4.9.s390.rpm
b45278314ff79575284af2a0ddf09f8f openssh-askpass-gnome-3.9p1-8.RHEL4.9.s390.rpm
eb0871dc10d5eb1541f2bd240b86d1bb openssh-clients-3.9p1-8.RHEL4.9.s390.rpm
fa1669804538da84a5b312d237eb65bc openssh-server-3.9p1-8.RHEL4.9.s390.rpm
s390x:
a26f854317e26af188704d5df98b302b openssh-3.9p1-8.RHEL4.9.s390x.rpm
7386e0e001ec6534c5666316f6ac1aa6 openssh-askpass-3.9p1-8.RHEL4.9.s390x.rpm
26e80a25582afc8665b853b9fd844907 openssh-askpass-gnome-3.9p1-8.RHEL4.9.s390x.rpm
65a0209831ac79f162f75e491ec7696a openssh-clients-3.9p1-8.RHEL4.9.s390x.rpm
2856776521344601307cdcbb9e6af2e6 openssh-server-3.9p1-8.RHEL4.9.s390x.rpm
x86_64:
8e2c46e097fff0172553d821e6810f91 openssh-3.9p1-8.RHEL4.9.x86_64.rpm
14a78c2264965373c6c56d63f73f60e5 openssh-askpass-3.9p1-8.RHEL4.9.x86_64.rpm
b799e4ed3d8d6aaf3439e06c5ee29b21 openssh-askpass-gnome-3.9p1-8.RHEL4.9.x86_64.rpm
e15d265ea0f955724b27cb15f2230f4f openssh-clients-3.9p1-8.RHEL4.9.x86_64.rpm
56bab36b63f94a4adcaa79ef026df03e openssh-server-3.9p1-8.RHEL4.9.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/openssh-3.9p1-8.RHEL4.9.src.rpm
2cbb0102ce3dc2c36c328819f8522bbc openssh-3.9p1-8.RHEL4.9.src.rpm
i386:
4a5add7335d6b6bcf9a202e45e782eee openssh-3.9p1-8.RHEL4.9.i386.rpm
77cc6d8b6be9c613f80cd7d52c9f91e3 openssh-askpass-3.9p1-8.RHEL4.9.i386.rpm
76c9ac8255dbc25184887dd93cfdb047 openssh-askpass-gnome-3.9p1-8.RHEL4.9.i386.rpm
45350fbd7c5356467ebfc2e2a7bfc55a openssh-clients-3.9p1-8.RHEL4.9.i386.rpm
32e69cc88f09f6785badd3b82fdccb31 openssh-server-3.9p1-8.RHEL4.9.i386.rpm
x86_64:
8e2c46e097fff0172553d821e6810f91 openssh-3.9p1-8.RHEL4.9.x86_64.rpm
14a78c2264965373c6c56d63f73f60e5 openssh-askpass-3.9p1-8.RHEL4.9.x86_64.rpm
b799e4ed3d8d6aaf3439e06c5ee29b21 openssh-askpass-gnome-3.9p1-8.RHEL4.9.x86_64.rpm
e15d265ea0f955724b27cb15f2230f4f openssh-clients-3.9p1-8.RHEL4.9.x86_64.rpm
56bab36b63f94a4adcaa79ef026df03e openssh-server-3.9p1-8.RHEL4.9.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/openssh-3.9p1-8.RHEL4.9.src.rpm
2cbb0102ce3dc2c36c328819f8522bbc openssh-3.9p1-8.RHEL4.9.src.rpm
i386:
4a5add7335d6b6bcf9a202e45e782eee openssh-3.9p1-8.RHEL4.9.i386.rpm
77cc6d8b6be9c613f80cd7d52c9f91e3 openssh-askpass-3.9p1-8.RHEL4.9.i386.rpm
76c9ac8255dbc25184887dd93cfdb047 openssh-askpass-gnome-3.9p1-8.RHEL4.9.i386.rpm
45350fbd7c5356467ebfc2e2a7bfc55a openssh-clients-3.9p1-8.RHEL4.9.i386.rpm
32e69cc88f09f6785badd3b82fdccb31 openssh-server-3.9p1-8.RHEL4.9.i386.rpm
ia64:
f27d73d28c920358dcb434c3ed8489cf openssh-3.9p1-8.RHEL4.9.ia64.rpm
512632b31d333408cf2e05a3e567e16a openssh-askpass-3.9p1-8.RHEL4.9.ia64.rpm
6771aafbd50b0ead67418404cbd63711 openssh-askpass-gnome-3.9p1-8.RHEL4.9.ia64.rpm
0355970673f296c38ee961549665b64d openssh-clients-3.9p1-8.RHEL4.9.ia64.rpm
40fa71b924423c63af6215255cc21198 openssh-server-3.9p1-8.RHEL4.9.ia64.rpm
x86_64:
8e2c46e097fff0172553d821e6810f91 openssh-3.9p1-8.RHEL4.9.x86_64.rpm
14a78c2264965373c6c56d63f73f60e5 openssh-askpass-3.9p1-8.RHEL4.9.x86_64.rpm
b799e4ed3d8d6aaf3439e06c5ee29b21 openssh-askpass-gnome-3.9p1-8.RHEL4.9.x86_64.rpm
e15d265ea0f955724b27cb15f2230f4f openssh-clients-3.9p1-8.RHEL4.9.x86_64.rpm
56bab36b63f94a4adcaa79ef026df03e openssh-server-3.9p1-8.RHEL4.9.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/openssh-3.9p1-8.RHEL4.9.src.rpm
2cbb0102ce3dc2c36c328819f8522bbc openssh-3.9p1-8.RHEL4.9.src.rpm
i386:
4a5add7335d6b6bcf9a202e45e782eee openssh-3.9p1-8.RHEL4.9.i386.rpm
77cc6d8b6be9c613f80cd7d52c9f91e3 openssh-askpass-3.9p1-8.RHEL4.9.i386.rpm
76c9ac8255dbc25184887dd93cfdb047 openssh-askpass-gnome-3.9p1-8.RHEL4.9.i386.rpm
45350fbd7c5356467ebfc2e2a7bfc55a openssh-clients-3.9p1-8.RHEL4.9.i386.rpm
32e69cc88f09f6785badd3b82fdccb31 openssh-server-3.9p1-8.RHEL4.9.i386.rpm
ia64:
f27d73d28c920358dcb434c3ed8489cf openssh-3.9p1-8.RHEL4.9.ia64.rpm
512632b31d333408cf2e05a3e567e16a openssh-askpass-3.9p1-8.RHEL4.9.ia64.rpm
6771aafbd50b0ead67418404cbd63711 openssh-askpass-gnome-3.9p1-8.RHEL4.9.ia64.rpm
0355970673f296c38ee961549665b64d openssh-clients-3.9p1-8.RHEL4.9.ia64.rpm
40fa71b924423c63af6215255cc21198 openssh-server-3.9p1-8.RHEL4.9.ia64.rpm
x86_64:
8e2c46e097fff0172553d821e6810f91 openssh-3.9p1-8.RHEL4.9.x86_64.rpm
14a78c2264965373c6c56d63f73f60e5 openssh-askpass-3.9p1-8.RHEL4.9.x86_64.rpm
b799e4ed3d8d6aaf3439e06c5ee29b21 openssh-askpass-gnome-3.9p1-8.RHEL4.9.x86_64.rpm
e15d265ea0f955724b27cb15f2230f4f openssh-clients-3.9p1-8.RHEL4.9.x86_64.rpm
56bab36b63f94a4adcaa79ef026df03e openssh-server-3.9p1-8.RHEL4.9.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2798
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2005 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQFDQ9knXlSAg2UNWIIRAhdLAJ9tNlp2XzFuYxEvq73PN21Wz5r/XgCfXIo+
xmmImgrMIFz0n4E7QgpnRk0=
=xCQP
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBQ0SDCCh9+71yA2DNAQIfowP+LhSZMzDRNNOPuiRiXBKm4hW/BhFTGcqR
scMWtKFCShOcbdbmlm4WR+dSpcqNYi5EyGln6UMAsI3I3HllFLm3W3FB8PfyVQwR
4EXGHo8R6Ffr8mb8yRqV0ejd/CIeNaKl/7E/fG7Wk5wuHG0m+tQmUBYB6KkKWsRG
XsWuU1stC6Y=
=0HH2
-----END PGP SIGNATURE-----