Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2014.1842 Moderate: openssh security, bug fix, and enhancement update 15 October 2014 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: openssh Publisher: Red Hat Operating System: Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux WS/Desktop 6 Impact/Access: Unauthorised Access -- Remote/Unauthenticated Reduced Security -- Remote with User Interaction Resolution: Patch/Upgrade CVE Names: CVE-2014-2653 CVE-2014-2532 Reference: ESB-2014.1197 ESB-2014.0997 ESB-2014.0444 ESB-2014.0363 Original Bulletin: https://rhn.redhat.com/errata/RHSA-2014-1552.html - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: openssh security, bug fix, and enhancement update Advisory ID: RHSA-2014:1552-02 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-1552.html Issue date: 2014-10-14 CVE Names: CVE-2014-2532 CVE-2014-2653 ===================================================================== 1. Summary: Updated openssh packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 3. Description: OpenSSH is OpenBSD's SSH (Secure Shell) protocol implementation. These packages include the core files necessary for both the OpenSSH client and server. It was discovered that OpenSSH clients did not correctly verify DNS SSHFP records. A malicious server could use this flaw to force a connecting client to skip the DNS SSHFP record check and require the user to perform manual host verification of the DNS SSHFP record. (CVE-2014-2653) It was found that OpenSSH did not properly handle certain AcceptEnv parameter values with wildcard characters. A remote attacker could use this flaw to bypass intended environment variable restrictions. (CVE-2014-2532) This update also fixes the following bugs: * Based on the SP800-131A information security standard, the generation of a digital signature using the Digital Signature Algorithm (DSA) with the key size of 1024 bits and RSA with the key size of less than 2048 bits is disallowed after the year 2013. After this update, ssh-keygen no longer generates keys with less than 2048 bits in FIPS mode. However, the sshd service accepts keys of size 1024 bits as well as larger keys for compatibility reasons. (BZ#993580) * Previously, the openssh utility incorrectly set the oom_adj value to -17 for all of its children processes. This behavior was incorrect because the children processes were supposed to have this value set to 0. This update applies a patch to fix this bug and oom_adj is now properly set to 0 for all children processes as expected. (BZ#1010429) * Previously, if the sshd service failed to verify the checksum of an installed FIPS module using the fipscheck library, the information about this failure was only provided at the standard error output of sshd. As a consequence, the user could not notice this message and be uninformed when a system had not been properly configured for FIPS mode. To fix this bug, this behavior has been changed and sshd now sends such messages via the syslog service. (BZ#1020803) * When keys provided by the pkcs11 library were removed from the ssh agent using the "ssh-add -e" command, the user was prompted to enter a PIN. With this update, a patch has been applied to allow the user to remove the keys provided by pkcs11 without the PIN. (BZ#1042519) In addition, this update adds the following enhancements: * With this update, ControlPersist has been added to OpenSSH. The option in conjunction with the ControlMaster configuration directive specifies that the master connection remains open in the background after the initial client connection has been closed. (BZ#953088) * When the sshd daemon is configured to force the internal SFTP session, and the user attempts to use a connection other than SFTP, the appropriate message is logged to the /var/log/secure file. (BZ#997377) * Support for Elliptic Curve Cryptography modes for key exchange (ECDH) and host user keys (ECDSA) as specified by RFC5656 has been added to the openssh packages. However, they are not enabled by default and the user has to enable them manually. For more information on how to configure ECDSA and ECDH with OpenSSH, see: https://access.redhat.com/solutions/711953 (BZ#1028335) All openssh users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 953088 - OpenSSH adding ControlPersist patch to enable full usage of SSH control options 1010429 - Openssh Incorrectly sets oom_adj in all Children after Performing a Reload 1023043 - ssh_config manual page lists incorrect default value of KexAlgorithms 1023044 - Fix man page for ssh-keygen because of certificate support 1027197 - X11 Forwarding does not work with default config - error: Failed to allocate internet-domain X11 display socket 1028643 - Connection remains when fork() fails. 1077843 - CVE-2014-2532 openssh: AcceptEnv environment restriction bypass flaw 1081338 - CVE-2014-2653 openssh: failure to check DNS SSHFP records in certain scenarios 1108836 - ssh-keyscan should ignore SIGPIPE 1111568 - AUTOCREATE_SERVER_KEYS=RSAONLY is not supported by init script 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: openssh-5.3p1-104.el6.src.rpm i386: openssh-5.3p1-104.el6.i686.rpm openssh-askpass-5.3p1-104.el6.i686.rpm openssh-clients-5.3p1-104.el6.i686.rpm openssh-debuginfo-5.3p1-104.el6.i686.rpm openssh-server-5.3p1-104.el6.i686.rpm x86_64: openssh-5.3p1-104.el6.x86_64.rpm openssh-askpass-5.3p1-104.el6.x86_64.rpm openssh-clients-5.3p1-104.el6.x86_64.rpm openssh-debuginfo-5.3p1-104.el6.x86_64.rpm openssh-server-5.3p1-104.el6.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): i386: openssh-debuginfo-5.3p1-104.el6.i686.rpm openssh-ldap-5.3p1-104.el6.i686.rpm pam_ssh_agent_auth-0.9.3-104.el6.i686.rpm x86_64: openssh-debuginfo-5.3p1-104.el6.i686.rpm openssh-debuginfo-5.3p1-104.el6.x86_64.rpm openssh-ldap-5.3p1-104.el6.x86_64.rpm pam_ssh_agent_auth-0.9.3-104.el6.i686.rpm pam_ssh_agent_auth-0.9.3-104.el6.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: openssh-5.3p1-104.el6.src.rpm x86_64: openssh-5.3p1-104.el6.x86_64.rpm openssh-clients-5.3p1-104.el6.x86_64.rpm openssh-debuginfo-5.3p1-104.el6.x86_64.rpm openssh-server-5.3p1-104.el6.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): x86_64: openssh-askpass-5.3p1-104.el6.x86_64.rpm openssh-debuginfo-5.3p1-104.el6.i686.rpm openssh-debuginfo-5.3p1-104.el6.x86_64.rpm openssh-ldap-5.3p1-104.el6.x86_64.rpm pam_ssh_agent_auth-0.9.3-104.el6.i686.rpm pam_ssh_agent_auth-0.9.3-104.el6.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: openssh-5.3p1-104.el6.src.rpm i386: openssh-5.3p1-104.el6.i686.rpm openssh-askpass-5.3p1-104.el6.i686.rpm openssh-clients-5.3p1-104.el6.i686.rpm openssh-debuginfo-5.3p1-104.el6.i686.rpm openssh-server-5.3p1-104.el6.i686.rpm ppc64: openssh-5.3p1-104.el6.ppc64.rpm openssh-askpass-5.3p1-104.el6.ppc64.rpm openssh-clients-5.3p1-104.el6.ppc64.rpm openssh-debuginfo-5.3p1-104.el6.ppc64.rpm openssh-server-5.3p1-104.el6.ppc64.rpm s390x: openssh-5.3p1-104.el6.s390x.rpm openssh-askpass-5.3p1-104.el6.s390x.rpm openssh-clients-5.3p1-104.el6.s390x.rpm openssh-debuginfo-5.3p1-104.el6.s390x.rpm openssh-server-5.3p1-104.el6.s390x.rpm x86_64: openssh-5.3p1-104.el6.x86_64.rpm openssh-askpass-5.3p1-104.el6.x86_64.rpm openssh-clients-5.3p1-104.el6.x86_64.rpm openssh-debuginfo-5.3p1-104.el6.x86_64.rpm openssh-server-5.3p1-104.el6.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): i386: openssh-debuginfo-5.3p1-104.el6.i686.rpm openssh-ldap-5.3p1-104.el6.i686.rpm pam_ssh_agent_auth-0.9.3-104.el6.i686.rpm ppc64: openssh-debuginfo-5.3p1-104.el6.ppc.rpm openssh-debuginfo-5.3p1-104.el6.ppc64.rpm openssh-ldap-5.3p1-104.el6.ppc64.rpm pam_ssh_agent_auth-0.9.3-104.el6.ppc.rpm pam_ssh_agent_auth-0.9.3-104.el6.ppc64.rpm s390x: openssh-debuginfo-5.3p1-104.el6.s390.rpm openssh-debuginfo-5.3p1-104.el6.s390x.rpm openssh-ldap-5.3p1-104.el6.s390x.rpm pam_ssh_agent_auth-0.9.3-104.el6.s390.rpm pam_ssh_agent_auth-0.9.3-104.el6.s390x.rpm x86_64: openssh-debuginfo-5.3p1-104.el6.i686.rpm openssh-debuginfo-5.3p1-104.el6.x86_64.rpm openssh-ldap-5.3p1-104.el6.x86_64.rpm pam_ssh_agent_auth-0.9.3-104.el6.i686.rpm pam_ssh_agent_auth-0.9.3-104.el6.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: openssh-5.3p1-104.el6.src.rpm i386: openssh-5.3p1-104.el6.i686.rpm openssh-askpass-5.3p1-104.el6.i686.rpm openssh-clients-5.3p1-104.el6.i686.rpm openssh-debuginfo-5.3p1-104.el6.i686.rpm openssh-server-5.3p1-104.el6.i686.rpm x86_64: openssh-5.3p1-104.el6.x86_64.rpm openssh-askpass-5.3p1-104.el6.x86_64.rpm openssh-clients-5.3p1-104.el6.x86_64.rpm openssh-debuginfo-5.3p1-104.el6.x86_64.rpm openssh-server-5.3p1-104.el6.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): i386: openssh-debuginfo-5.3p1-104.el6.i686.rpm openssh-ldap-5.3p1-104.el6.i686.rpm pam_ssh_agent_auth-0.9.3-104.el6.i686.rpm x86_64: openssh-debuginfo-5.3p1-104.el6.i686.rpm openssh-debuginfo-5.3p1-104.el6.x86_64.rpm openssh-ldap-5.3p1-104.el6.x86_64.rpm pam_ssh_agent_auth-0.9.3-104.el6.i686.rpm pam_ssh_agent_auth-0.9.3-104.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2014-2532.html https://www.redhat.com/security/data/cve/CVE-2014-2653.html https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/solutions/711953 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFUPK1zXlSAg2UNWIIRAgLFAKCbc0zGun3IBr/70ChlueemUsEORgCfa8RL IT6RfneDJRTv3j8EqBZSrp0= =33Fn - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBVD3fsRLndAQH1ShLAQLbvA/9FpyUF058HWs2q7K59EL006IXd69UFAe6 NxngIqa8ikFm9/XA58uo2V02N26OVkK6mJZrFlIJ/yuwB1ILQbWfNP7JhTO20GBq y28oYLcS6zBY/1emFnPPD7T4OZRYOmtK2KZoZNUg5JHpA3+KZldx8wr0fzY5UGVe k/T/pO6b8xkaro4q8//9tBcZxd5O0fJXXuxZHoD5CTzBfAlCXUB9y9OnGeRJiEvn dI3gTf3iXMTdtqk2CqKJiviQe8FV46fgeaBtYFyeI+uKXyyBhqNATV24DOvLhS7p 6zJbfYaEARJjlx/tgSPS3a/c2Q2LHKRk9I0qs8PN9by58pfy8vvf9a3aSL6PkUTr QgbhhvQWUEA5xSbwbzFagdBYJ2g+E3ZxpPbapSmI1wq6LXSzSbELxFr9yDM/gJZM hGIrbGUHJGp+9TVMm4jm7JQH+DvjTTUQDH12/9Eh7Icu0P26pSyqqiuNvbvY8Jwp lYl5rBBCFp6ciLHpq5q6Af9MV1b41bkasidDuWFaL8KFgRveoE9DDKj7kGwTjzUa I0TSD0mWFJwkUvPIhBBjZaoPXGQgoGFllPyiTACJuOI02rQDkdArQZ0WG1iTyRSf Lr7DCR1F2dlDnsgQ3Nx01K/RBpbaMO9HuYpwZ6cGiNp86/cZFTdtNpZmEm//L6/z eUg/LR9yb78= =L/Ai -----END PGP SIGNATURE-----