Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2008.0880 -- [Debian] New openssh packages fix denial of service 17 September 2008 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: openssh Publisher: Debian Operating System: Debian GNU/Linux 4.0 Impact: Denial of Service Access: Remote/Unauthenticated CVE Names: CVE-2008-4109 Ref: ESB-2006.0846 Original Bulletin: http://www.debian.org/security/2008/dsa-1638 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - ------------------------------------------------------------------------ Debian Security Advisory DSA-1638-1 security@debian.org http://www.debian.org/security/ Florian Weimer September 16, 2008 http://www.debian.org/security/faq - - ------------------------------------------------------------------------ Package : openssh Vulnerability : remote Problem type : unsafe signal handler Debian-specific: no CVE Id(s) : CVE-2008-4109 Debian Bug : 498678 It has been discovered that the signal handler implementing the login timeout in Debian's version of the OpenSSH server uses functions which are not async-signal-safe, leading to a denial of service vulnerability (CVE-2008-4109). The problem was originally corrected in OpenSSH 4.4p1 (CVE-2006-5051), but the patch backported to the version released with etch was incorrect. Systems affected by this issue suffer from lots of zombie sshd processes. Processes stuck with a "[net]" process title have also been observed. Over time, a sufficient number of processes may accumulate such that further login attempts are impossible. Presence of these processes does not indicate active exploitation of this vulnerability. It is possible to trigger this denial of service condition by accident. For the stable distribution (etch), this problem has been fixed in version 4.3p2-9etch3. For the unstable distribution (sid) and the testing distribution (lenny), this problem has been fixed in version 4.6p1-1. We recommend that you upgrade your openssh packages. Upgrade instructions - - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 4.0 alias etch - - ------------------------------- Source archives: http://security.debian.org/pool/updates/main/o/openssh/openssh_4.3p2-9etch3.diff.gz Size/MD5 checksum: 275859 d36cb34826bb92eca24a9397369baee6 http://security.debian.org/pool/updates/main/o/openssh/openssh_4.3p2.orig.tar.gz Size/MD5 checksum: 920186 239fc801443acaffd4c1f111948ee69c http://security.debian.org/pool/updates/main/o/openssh/openssh_4.3p2-9etch3.dsc Size/MD5 checksum: 1310 1888a56e6050c8b8c2caf95e9da1db84 Architecture independent packages: http://security.debian.org/pool/updates/main/o/openssh/ssh-krb5_4.3p2-9etch3_all.deb Size/MD5 checksum: 91378 2748b67458de398e05e7c05227a0c612 http://security.debian.org/pool/updates/main/o/openssh/ssh_4.3p2-9etch3_all.deb Size/MD5 checksum: 1052 f47a80d017cd3184bc981a38ced31ee8 alpha architecture (DEC Alpha) http://security.debian.org/pool/updates/main/o/openssh/openssh-client_4.3p2-9etch3_alpha.deb Size/MD5 checksum: 782932 e7f3b896603dc1aebadb370d79ab90f5 http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_4.3p2-9etch3_alpha.deb Size/MD5 checksum: 100580 8ed4b61e252f3080073134abae2a36cd http://security.debian.org/pool/updates/main/o/openssh/openssh-server-udeb_4.3p2-9etch3_alpha.udeb Size/MD5 checksum: 213712 9eb6b65f9292db607a4b2d6bf498c54f http://security.debian.org/pool/updates/main/o/openssh/openssh-server_4.3p2-9etch3_alpha.deb Size/MD5 checksum: 266512 81805fcb11c56d7252ecdf4a1e74d713 http://security.debian.org/pool/updates/main/o/openssh/openssh-client-udeb_4.3p2-9etch3_alpha.udeb Size/MD5 checksum: 198516 d294a1db5f4257c4c58154bb160232f1 amd64 architecture (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/o/openssh/openssh-client_4.3p2-9etch3_amd64.deb Size/MD5 checksum: 710490 816deaa292a89d07a1d8b6ad196eb72d http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_4.3p2-9etch3_amd64.deb Size/MD5 checksum: 99976 05a863e6cd0aaced1cf8c774d7573274 http://security.debian.org/pool/updates/main/o/openssh/openssh-server-udeb_4.3p2-9etch3_amd64.udeb Size/MD5 checksum: 183846 a9c89a870bb58463606ec8b736643144 http://security.debian.org/pool/updates/main/o/openssh/openssh-server_4.3p2-9etch3_amd64.deb Size/MD5 checksum: 244368 9d0b3126c34e338b4f5216284518aea8 http://security.debian.org/pool/updates/main/o/openssh/openssh-client-udeb_4.3p2-9etch3_amd64.udeb Size/MD5 checksum: 171380 2cf03617de7bd22ff03b85f8ca2b25f0 arm architecture (ARM) http://security.debian.org/pool/updates/main/o/openssh/openssh-client_4.3p2-9etch3_arm.deb Size/MD5 checksum: 650726 a50736277f77d29a8cd59be5de31efe8 http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_4.3p2-9etch3_arm.deb Size/MD5 checksum: 99754 bee5a81d4168699a324ff572d6e436d6 http://security.debian.org/pool/updates/main/o/openssh/openssh-client-udeb_4.3p2-9etch3_arm.udeb Size/MD5 checksum: 164866 067f69be0283f3bb3cf697f4312d2bbb http://security.debian.org/pool/updates/main/o/openssh/openssh-server_4.3p2-9etch3_arm.deb Size/MD5 checksum: 218966 2a8dfbfc4e5abe2d333f20e123ad38ad http://security.debian.org/pool/updates/main/o/openssh/openssh-server-udeb_4.3p2-9etch3_arm.udeb Size/MD5 checksum: 171672 a0ce63abaee1e7cfbaf64e62dc8164b5 hppa architecture (HP PA RISC) http://security.debian.org/pool/updates/main/o/openssh/openssh-client_4.3p2-9etch3_hppa.deb Size/MD5 checksum: 732946 3177a89f68634880a3da10e054abe538 http://security.debian.org/pool/updates/main/o/openssh/openssh-client-udeb_4.3p2-9etch3_hppa.udeb Size/MD5 checksum: 189606 92ce0ac13874e3ec7ef20e7d97221850 http://security.debian.org/pool/updates/main/o/openssh/openssh-server_4.3p2-9etch3_hppa.deb Size/MD5 checksum: 249864 191165420d41b4ea84f7ae820a61dee1 http://security.debian.org/pool/updates/main/o/openssh/openssh-server-udeb_4.3p2-9etch3_hppa.udeb Size/MD5 checksum: 198138 af0b7c29c951135595170b63251dd484 http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_4.3p2-9etch3_hppa.deb Size/MD5 checksum: 100532 55db615aae32e2adf40dbe79b5fc7cf1 i386 architecture (Intel ia32) http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_4.3p2-9etch3_i386.deb Size/MD5 checksum: 99766 5844bc9b9aebd6da32ceba7b80017dea http://security.debian.org/pool/updates/main/o/openssh/openssh-server-udeb_4.3p2-9etch3_i386.udeb Size/MD5 checksum: 162626 b8ce1b90a26b1097ddfc5fb8323dc1d3 http://security.debian.org/pool/updates/main/o/openssh/openssh-server_4.3p2-9etch3_i386.deb Size/MD5 checksum: 223696 087b8d33303c197953ba2a9904345592 http://security.debian.org/pool/updates/main/o/openssh/openssh-client-udeb_4.3p2-9etch3_i386.udeb Size/MD5 checksum: 154038 308a4f0d415532bfa7b3836d70aaf4ea http://security.debian.org/pool/updates/main/o/openssh/openssh-client_4.3p2-9etch3_i386.deb Size/MD5 checksum: 659992 df6bf6ae7a34e91d5677115bbdb01b73 ia64 architecture (Intel ia64) http://security.debian.org/pool/updates/main/o/openssh/openssh-client_4.3p2-9etch3_ia64.deb Size/MD5 checksum: 962182 49dc85d747e2a50d8e37b9c4e7428e6e http://security.debian.org/pool/updates/main/o/openssh/openssh-server-udeb_4.3p2-9etch3_ia64.udeb Size/MD5 checksum: 269904 bf013bd6ab07afab765d6ca84be21666 http://security.debian.org/pool/updates/main/o/openssh/openssh-server_4.3p2-9etch3_ia64.deb Size/MD5 checksum: 338240 3fe40ae711c9c0c3689f5d8c50b70af7 http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_4.3p2-9etch3_ia64.deb Size/MD5 checksum: 101440 c49ecbbdd0101c8a90fcc9d4b60ae1c8 http://security.debian.org/pool/updates/main/o/openssh/openssh-client-udeb_4.3p2-9etch3_ia64.udeb Size/MD5 checksum: 251934 793c1d31b7a179a766ed57d6ad5649cf mips architecture (MIPS (Big Endian)) http://security.debian.org/pool/updates/main/o/openssh/openssh-client_4.3p2-9etch3_mips.deb Size/MD5 checksum: 732114 9ec13c1de7481000339c6f10ebb7f149 http://security.debian.org/pool/updates/main/o/openssh/openssh-client-udeb_4.3p2-9etch3_mips.udeb Size/MD5 checksum: 191298 d190ada9fd3c0420d949126c02fa85da http://security.debian.org/pool/updates/main/o/openssh/openssh-server_4.3p2-9etch3_mips.deb Size/MD5 checksum: 251044 c97d6f7d9baf2b1678289e9e067ea4d4 http://security.debian.org/pool/updates/main/o/openssh/openssh-server-udeb_4.3p2-9etch3_mips.udeb Size/MD5 checksum: 200554 028987ca5310b3fb2e6003ba385b2bd0 http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_4.3p2-9etch3_mips.deb Size/MD5 checksum: 99996 f52e7996ddb5f7bff8d6ced65f82bd2d powerpc architecture (PowerPC) http://security.debian.org/pool/updates/main/o/openssh/openssh-client-udeb_4.3p2-9etch3_powerpc.udeb Size/MD5 checksum: 168340 030a27c9ce4287f28669ba4a5af8247c http://security.debian.org/pool/updates/main/o/openssh/openssh-server_4.3p2-9etch3_powerpc.deb Size/MD5 checksum: 237020 3cde6fe4ab569ca83cc9616572be11ca http://security.debian.org/pool/updates/main/o/openssh/openssh-server-udeb_4.3p2-9etch3_powerpc.udeb Size/MD5 checksum: 173280 38bdde6d16b07399ba996dd66a6311ae http://security.debian.org/pool/updates/main/o/openssh/openssh-client_4.3p2-9etch3_powerpc.deb Size/MD5 checksum: 700832 6397ec69df1deb0c5e0bc4c58ffae141 http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_4.3p2-9etch3_powerpc.deb Size/MD5 checksum: 101248 bfcd1a41ede062d9449f5be7eb7cd16f s390 architecture (IBM S/390) http://security.debian.org/pool/updates/main/o/openssh/openssh-server_4.3p2-9etch3_s390.deb Size/MD5 checksum: 246734 9181c374dcb69441bd7ec030aadfb911 http://security.debian.org/pool/updates/main/o/openssh/openssh-client-udeb_4.3p2-9etch3_s390.udeb Size/MD5 checksum: 188516 a3786ab0a693ddb4f81fdeeead01ec51 http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_4.3p2-9etch3_s390.deb Size/MD5 checksum: 100226 73ec19e480b2e9b4c2809a04a77d27b9 http://security.debian.org/pool/updates/main/o/openssh/openssh-client_4.3p2-9etch3_s390.deb Size/MD5 checksum: 725828 7ff9eafecb36d2147305e08289ca22a4 http://security.debian.org/pool/updates/main/o/openssh/openssh-server-udeb_4.3p2-9etch3_s390.udeb Size/MD5 checksum: 196900 23c3164ff897157de7fdd6b334a39e95 sparc architecture (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/o/openssh/openssh-client_4.3p2-9etch3_sparc.deb Size/MD5 checksum: 640266 7c833bcc2eb5a606be3bc4243313bc97 http://security.debian.org/pool/updates/main/o/openssh/openssh-server_4.3p2-9etch3_sparc.deb Size/MD5 checksum: 218194 eceb87ee9c789edfae071afe782c3a5f http://security.debian.org/pool/updates/main/o/openssh/openssh-server-udeb_4.3p2-9etch3_sparc.udeb Size/MD5 checksum: 166716 869791f368a6de4cfc3ddd818be8c33f http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_4.3p2-9etch3_sparc.deb Size/MD5 checksum: 99714 8564652d41a2c1709c6d3794b241ddc5 http://security.debian.org/pool/updates/main/o/openssh/openssh-client-udeb_4.3p2-9etch3_sparc.udeb Size/MD5 checksum: 158356 d2f2015c554f5f1cd918d07559f82ebd These files will probably be moved into the stable distribution on its next update. - - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iQEcBAEBAgAGBQJI0Bl3AAoJEL97/wQC1SS+wIsIAJ91WnpBmk2Xkoyauc1ODZyL KHOQ+NKy9DgjZ9GsHhPWQIcPbc1HjIbtsMhp+xDyZsM+f9e/+1lrqmqsGE4Nnyhj YKFpnvD7d/wgUWvB/mc8znqL3iW0XNu71o5fgW2JQ8AE9R5erhcJqPijyV/Kakuw ASlAtGIgJ7Z/8kExMiwM8eA9MAat6K4ISWDIHKXMegaUGsXQKU6THmZ5+ony3sBG M8ur+hH70PFsWr/aj5dkqLl9sMQOp9u/FmodK//W3OOEKh5SUkbw5PYQ8qqHHMI3 4Nm9+R207pd3IM4kr7kiMdVzz7gE4doFxrgwkxVfKO2vbdwoZeY5HPMIBFgYjUM= =GId6 - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 If you believe that your computer system has been compromised or attacked in any way, we encourage you to let us know by completing the secure National IT Incident Reporting Form at: http://www.auscert.org.au/render.html?it=3192 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQCUAwUBSNBD9yh9+71yA2DNAQLjygP0DMHtldpDDo7dUEadsAVrztdwNxp/Xwnd NaaRZkh8kpVPtUYBDriXk/8/o0is3p6nn3gg0GIEARDX0Dhxnps+LVMCnCYAZVaM 65XlXP5JQAS1vYnnIj5CqOXU4QFQK5D9HbzuycNumtpeXNGzeM/YjW/pKCvWqPvQ WeNln8EToA== =1qPF -----END PGP SIGNATURE-----