Message-ID: <20080514171209.GB7483@severus.strandboge.com>
Date: Wed, 14 May 2008 13:12:09 -0400
From: Jamie Strandboge <jamie@...onical.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: [USN-612-5] OpenSSH update

=========================================================== 
Ubuntu Security Notice USN-612-5               May 14, 2008
openssh update
https://launchpad.net/bugs/230029
http://www.ubuntu.com/usn/usn-612-2
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 7.04
Ubuntu 7.10
Ubuntu 8.04 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 7.04:
  openssh-client                  1:4.3p2-8ubuntu1.4
  openssh-client-udeb             1:4.3p2-8ubuntu1.4

Ubuntu 7.10:
  openssh-client                  1:4.6p1-5ubuntu0.5
  openssh-client-udeb             1:4.6p1-5ubuntu0.5

Ubuntu 8.04 LTS:
  openssh-client                  1:4.7p1-8ubuntu1.2
  openssh-client-udeb             1:4.7p1-8ubuntu1.2

After performing a standard system upgrade, users are encouraged to
re-run ssh-vulnkey on their systems.

Details follow:

Matt Zimmerman discovered that entries in ~/.ssh/authorized_keys
with options (such as "no-port-forwarding" or forced commands) were
ignored by the new ssh-vulnkey tool introduced in OpenSSH (see
USN-612-2). This could cause some compromised keys not to be
listed in ssh-vulnkey's output.

This update also adds more information to ssh-vulnkey's manual page.

Original advisory details:

 A weakness has been discovered in the random number generator used
 by OpenSSL on Debian and Ubuntu systems.  As a result of this
 weakness, certain encryption keys are much more common than they
 should be, such that an attacker could guess the key through a
 brute-force attack given minimal knowledge of the system.  This
 particularly affects the use of encryption keys in OpenSSH, OpenVPN
 and SSL certificates.


Updated packages for Ubuntu 7.04:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.3p2-8ubuntu1.4.diff.gz
      Size/MD5:   275922 b4c4369358cb99b5b7310671b4b6c644
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.3p2-8ubuntu1.4.dsc
      Size/MD5:     1074 b62e8d1771f57591e38883630e8909c1
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.3p2.orig.tar.gz
      Size/MD5:   920186 239fc801443acaffd4c1f111948ee69c

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh_4.3p2-8ubuntu1.4_all.deb
      Size/MD5:     1088 a41a7529e7dd57d65732a87fd4d12b1a
    http://security.ubuntu.com/ubuntu/pool/universe/o/openssh/ssh-krb5_4.3p2-8ubuntu1.4_all.deb
      Size/MD5:    93516 1f18571e095d82d33d59a4b18ea1131d

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.3p2-8ubuntu1.4_amd64.udeb
      Size/MD5:   173114 745de83450fd428f59b49819180ea6e5
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.3p2-8ubuntu1.4_amd64.deb
      Size/MD5:   739984 c2b5359b14584f2ddd0a127b1e54ab05
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.3p2-8ubuntu1.4_amd64.udeb
      Size/MD5:   185950 1e400a17bef0a1a046e3c6fe300d6cf1
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.3p2-8ubuntu1.4_amd64.deb
      Size/MD5:   255684 ecffa0f893439bf7aa9dfa7794bb5865
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.3p2-8ubuntu1.4_amd64.deb
      Size/MD5:   101900 07669fcf7d23a6e2f2790b5024e25107

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.3p2-8ubuntu1.4_i386.udeb
      Size/MD5:   156808 50fb7499a1b3eaed7ce807d3159e901f
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.3p2-8ubuntu1.4_i386.deb
      Size/MD5:   701964 93e2dda8a8bba51d2e1605960ed17222
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.3p2-8ubuntu1.4_i386.udeb
      Size/MD5:   165478 3909dc0d1a3db832846523ecba68ed71
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.3p2-8ubuntu1.4_i386.deb
      Size/MD5:   238158 38ac65e30b8c84b66ab8f982a630144d
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.3p2-8ubuntu1.4_i386.deb
      Size/MD5:   101600 2f46f59002999da1d748a602d9df93eb

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.3p2-8ubuntu1.4_powerpc.udeb
      Size/MD5:   178914 5f6bfcb0dfa67657a8af8b198d88189f
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.3p2-8ubuntu1.4_powerpc.deb
      Size/MD5:   767888 b7456adaa4daf3d37f43d872876251dd
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.3p2-8ubuntu1.4_powerpc.udeb
      Size/MD5:   184134 42cbfb13531030487616726f2a853c1b
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.3p2-8ubuntu1.4_powerpc.deb
      Size/MD5:   259740 eb05ac7cbce7b5ef92055775e9c45f67
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.3p2-8ubuntu1.4_powerpc.deb
      Size/MD5:   104364 3746fc6939f23cb8233daba48f784848

  sparc architecture (Sun SPARC/UltraSPARC):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.3p2-8ubuntu1.4_sparc.udeb
      Size/MD5:   164244 3579357d22d64142d52d8acd4e393921
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.3p2-8ubuntu1.4_sparc.deb
      Size/MD5:   751848 23d4205b7464735b63ecd28f0b789c02
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.3p2-8ubuntu1.4_sparc.udeb
      Size/MD5:   172576 e12ca4505449cb662a293d720e4fce4e
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.3p2-8ubuntu1.4_sparc.deb
      Size/MD5:   263476 276993c59b460c401920cfabcea46609
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.3p2-8ubuntu1.4_sparc.deb
      Size/MD5:   101842 a8e676070f9512084d59d756f8a9f409

Updated packages for Ubuntu 7.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.6p1-5ubuntu0.5.diff.gz
      Size/MD5:   195823 5e9c4f68f3cd8bf5da85295ada5e0b81
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.6p1-5ubuntu0.5.dsc
      Size/MD5:     1169 b9acd86dd071c671af4187c47185f851
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.6p1.orig.tar.gz
      Size/MD5:   946439 cee58cd226138191561fa2d484e18f49

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh_4.6p1-5ubuntu0.5_all.deb
      Size/MD5:     1094 206c8e29f1a6dfb217c2d3d90d44bd79
    http://security.ubuntu.com/ubuntu/pool/universe/o/openssh/ssh-krb5_4.6p1-5ubuntu0.5_all.deb
      Size/MD5:    80726 a49a595a3a8cfe999f1dbd26c1731f89

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.6p1-5ubuntu0.5_amd64.udeb
      Size/MD5:   176418 362c6c124bbb2705f0d9c79132bf97a3
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.6p1-5ubuntu0.5_amd64.deb
      Size/MD5:   747150 6e9a7a119044564417b8968b980e26f1
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.6p1-5ubuntu0.5_amd64.udeb
      Size/MD5:   193380 1ecfc5db02898f44ed7391dc3e9b8403
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.6p1-5ubuntu0.5_amd64.deb
      Size/MD5:   268756 104dff635669efaed7d6a77356ca0f8e
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.6p1-5ubuntu0.5_amd64.deb
      Size/MD5:    88872 5b1a65df20e6ea4790be10e17c428fbc

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.6p1-5ubuntu0.5_i386.udeb
      Size/MD5:   158796 2285a51be1c93f2b34d67f15e6fdbb82
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.6p1-5ubuntu0.5_i386.deb
      Size/MD5:   706228 0631165438b1766e0db78765bfdb060e
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.6p1-5ubuntu0.5_i386.udeb
      Size/MD5:   171690 268e919d460622342f3b21d3aa9e79b5
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.6p1-5ubuntu0.5_i386.deb
      Size/MD5:   249768 378a2928fa89616f8b07a352c3e175d3
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.6p1-5ubuntu0.5_i386.deb
      Size/MD5:    88516 d8c693407af5aaf4e102461171f3ee2a

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/o/openssh/openssh-client-udeb_4.6p1-5ubuntu0.5_lpia.udeb
      Size/MD5:   158874 3cca405136fb0a926c931140297f8288
    http://ports.ubuntu.com/pool/main/o/openssh/openssh-client_4.6p1-5ubuntu0.5_lpia.deb
      Size/MD5:   677026 5b75905823737b22f9d088596109b003
    http://ports.ubuntu.com/pool/main/o/openssh/openssh-server-udeb_4.6p1-5ubuntu0.5_lpia.udeb
      Size/MD5:   171276 944b04a5ab7da2dea705b306717f0784
    http://ports.ubuntu.com/pool/main/o/openssh/openssh-server_4.6p1-5ubuntu0.5_lpia.deb
      Size/MD5:   243102 c465a99059c88b98df2dc3dee60ca4e9
    http://ports.ubuntu.com/pool/main/o/openssh/ssh-askpass-gnome_4.6p1-5ubuntu0.5_lpia.deb
      Size/MD5:    88558 5f792ee09a6c0237072f84c1f95b3f15

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.6p1-5ubuntu0.5_powerpc.udeb
      Size/MD5:   180852 7a253eac52ef9708fcd5d5f689f05018
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.6p1-5ubuntu0.5_powerpc.deb
      Size/MD5:   774340 395be37533f4edc219863fd9bba242a6
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.6p1-5ubuntu0.5_powerpc.udeb
      Size/MD5:   190236 f3063bd6ad4ebc74c6232515276e4114
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.6p1-5ubuntu0.5_powerpc.deb
      Size/MD5:   272004 2d6a98684f6e915c82b958ca7823d237
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.6p1-5ubuntu0.5_powerpc.deb
      Size/MD5:    91234 f3e1454cb89fea2dbdd20fcbfcd52386

  sparc architecture (Sun SPARC/UltraSPARC):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.6p1-5ubuntu0.5_sparc.udeb
      Size/MD5:   166886 7895b2872ae485b385039e760d5f44ec
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.6p1-5ubuntu0.5_sparc.deb
      Size/MD5:   759160 129a2a85c91eb3f8d5a1165cef9391fb
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.6p1-5ubuntu0.5_sparc.udeb
      Size/MD5:   179100 9bbca7ca7ecb4e4fa9e16cfe531911c4
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.6p1-5ubuntu0.5_sparc.deb
      Size/MD5:   276562 0a5a7c1f1af8d5d4b5928d932b9f8a33
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.6p1-5ubuntu0.5_sparc.deb
      Size/MD5:    88840 bd7bc566ead7a834eae8519ef06db84c

Updated packages for Ubuntu 8.04 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.7p1-8ubuntu1.2.diff.gz
      Size/MD5:   209139 80acb15215b83533f187fac836e24ca1
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.7p1-8ubuntu1.2.dsc
      Size/MD5:     1135 6e43d250b57c64d6b942083668589f97
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.7p1.orig.tar.gz
      Size/MD5:  1009361 bea83d2e0f9ac7b3d4393d693e68b5c1

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh_4.7p1-8ubuntu1.2_all.deb
      Size/MD5:     1084 0f68b9046c74db0e57bddd6c1b739bbf
    http://security.ubuntu.com/ubuntu/pool/universe/o/openssh/ssh-krb5_4.7p1-8ubuntu1.2_all.deb
      Size/MD5:    88848 f6e0f4ef0046a7897736c46cc108508a

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.7p1-8ubuntu1.2_amd64.udeb
      Size/MD5:   179260 f2a58225ba895c261ef823086be965c5
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.7p1-8ubuntu1.2_amd64.deb
      Size/MD5:   760846 c727a95841f0d0c94f114884e6a99ac0
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.7p1-8ubuntu1.2_amd64.udeb
      Size/MD5:   195496 62cfa3d52ce0918f88787b30cc8b7e25
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.7p1-8ubuntu1.2_amd64.deb
      Size/MD5:   272818 8f3310bde9e7420d2a698b055ea73ecb
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.7p1-8ubuntu1.2_amd64.deb
      Size/MD5:    96744 c3a3f0eb608c9c1a9ca0e35061494415

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.7p1-8ubuntu1.2_i386.udeb
      Size/MD5:   161824 f516011da3156b43ecdfa2724e63fbb9
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.7p1-8ubuntu1.2_i386.deb
      Size/MD5:   720448 b1945e94fa0397da83ef5af705ae1f26
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.7p1-8ubuntu1.2_i386.udeb
      Size/MD5:   174332 3604f10b4e2619edce52f50303a98881
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.7p1-8ubuntu1.2_i386.deb
      Size/MD5:   254020 6710da9f44ac6e18a4627afbb7505f26
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.7p1-8ubuntu1.2_i386.deb
      Size/MD5:    96384 dd61e122cc6e69fd6ea61ec368b35741

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/o/openssh/openssh-client-udeb_4.7p1-8ubuntu1.2_lpia.udeb
      Size/MD5:   161636 65e704f5528a147579ae40de2c487765
    http://ports.ubuntu.com/pool/main/o/openssh/openssh-client_4.7p1-8ubuntu1.2_lpia.deb
      Size/MD5:   713956 a619b1749570ce9864b343132f1e5d13
    http://ports.ubuntu.com/pool/main/o/openssh/openssh-server-udeb_4.7p1-8ubuntu1.2_lpia.udeb
      Size/MD5:   174210 b31d7b694d937f0025ff96069d334158
    http://ports.ubuntu.com/pool/main/o/openssh/openssh-server_4.7p1-8ubuntu1.2_lpia.deb
      Size/MD5:   252856 368e0e5fa2665faadfd8ad63341acf87
    http://ports.ubuntu.com/pool/main/o/openssh/ssh-askpass-gnome_4.7p1-8ubuntu1.2_lpia.deb
      Size/MD5:    96412 ebe007544778b04ec01a89a1e0e3e2bc

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/o/openssh/openssh-client-udeb_4.7p1-8ubuntu1.2_powerpc.udeb
      Size/MD5:   185712 bdbaeeea99557baf7c19e2a0f70abd2a
    http://ports.ubuntu.com/pool/main/o/openssh/openssh-client_4.7p1-8ubuntu1.2_powerpc.deb
      Size/MD5:   797596 2129e032f78d1d4e13e1890c3bf7f85f
    http://ports.ubuntu.com/pool/main/o/openssh/openssh-server-udeb_4.7p1-8ubuntu1.2_powerpc.udeb
      Size/MD5:   194522 e9263b742d7b7319d598cb44c4049f1d
    http://ports.ubuntu.com/pool/main/o/openssh/openssh-server_4.7p1-8ubuntu1.2_powerpc.deb
      Size/MD5:   279014 4f5e89c16964c533ad0fafd1d7e2da60
    http://ports.ubuntu.com/pool/main/o/openssh/ssh-askpass-gnome_4.7p1-8ubuntu1.2_powerpc.deb
      Size/MD5:    99164 9511ff26b13272bceb56c98066e6c4a9

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/o/openssh/openssh-client-udeb_4.7p1-8ubuntu1.2_sparc.udeb
      Size/MD5:   169976 0b6c2aa06082048a1df1c44e924a385c
    http://ports.ubuntu.com/pool/main/o/openssh/openssh-client_4.7p1-8ubuntu1.2_sparc.deb
      Size/MD5:   723794 42355feee72c77139e88c383fd33d920
    http://ports.ubuntu.com/pool/main/o/openssh/openssh-server-udeb_4.7p1-8ubuntu1.2_sparc.udeb
      Size/MD5:   181574 d5e603a641b3238f172715d71624fbc9
    http://ports.ubuntu.com/pool/main/o/openssh/openssh-server_4.7p1-8ubuntu1.2_sparc.deb
      Size/MD5:   258324 871b3c0e5b963225ce9e79d02483de7a
    http://ports.ubuntu.com/pool/main/o/openssh/ssh-askpass-gnome_4.7p1-8ubuntu1.2_sparc.deb
      Size/MD5:    96612 2ed0f8f6827dda7f51c942b1b1533729



Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)

Powered by blists - more mailing lists