full-disclosure - [ MDVSA-2008:098 ] - Updated openssh packages fix vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-id: <E1JtX9Y-0007OW-9A@titan.mandriva.com>
Date: Tue, 06 May 2008 18:05:00 -0600
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2008:098 ] - Updated openssh packages fix
	vulnerability


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDVSA-2008:098
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : openssh
 Date    : May 6, 2008
 Affected: 2007.1, 2008.0, 2008.1
 _______________________________________________________________________
 
 Problem Description:
 
 A vulnerability in OpenSSH 4.4 through 4.8 allowed local attackers
 to bypass intended security restrictions enabling them to execute
 commands other than those specified by the ForceCommand directive,
 provided they are able to modify to ~/.ssh/rc (CVE-2008-1657).
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1657
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2007.1:
 08f6f5bdd307e17c510aa5d100f91ef3  2007.1/i586/openssh-4.6p1-1.3mdv2007.1.i586.rpm
 235d55d80b04e360e8d7c5fa94633251  2007.1/i586/openssh-askpass-4.6p1-1.3mdv2007.1.i586.rpm
 09d544148faf91e07782b663f7010e51  2007.1/i586/openssh-askpass-common-4.6p1-1.3mdv2007.1.i586.rpm
 379538dd86330b4577ee785bcd565962  2007.1/i586/openssh-askpass-gnome-4.6p1-1.3mdv2007.1.i586.rpm
 e6e85335d7d25e0fd51eaaeedfe8c02a  2007.1/i586/openssh-clients-4.6p1-1.3mdv2007.1.i586.rpm
 b9ef64c7c673c831dd06ad2191f9c5d7  2007.1/i586/openssh-server-4.6p1-1.3mdv2007.1.i586.rpm 
 8ea0e336e89c8f2c5a2cc777354a4705  2007.1/SRPMS/openssh-4.6p1-1.3mdv2007.1.src.rpm

 Mandriva Linux 2007.1/X86_64:
 3c021dffbaa950e10efeefcc5b286fef  2007.1/x86_64/openssh-4.6p1-1.3mdv2007.1.x86_64.rpm
 ad92d84d606f22f49fa95576d46d3870  2007.1/x86_64/openssh-askpass-4.6p1-1.3mdv2007.1.x86_64.rpm
 61aacfe978daa0447306778ed77cc5f0  2007.1/x86_64/openssh-askpass-common-4.6p1-1.3mdv2007.1.x86_64.rpm
 ad2a37a51549e8d06a0bfc1c71642d46  2007.1/x86_64/openssh-askpass-gnome-4.6p1-1.3mdv2007.1.x86_64.rpm
 d21605f50fc092f4e8a003a3a6cebaae  2007.1/x86_64/openssh-clients-4.6p1-1.3mdv2007.1.x86_64.rpm
 829c6e69c77c06653859e0106f80dece  2007.1/x86_64/openssh-server-4.6p1-1.3mdv2007.1.x86_64.rpm 
 8ea0e336e89c8f2c5a2cc777354a4705  2007.1/SRPMS/openssh-4.6p1-1.3mdv2007.1.src.rpm

 Mandriva Linux 2008.0:
 1eac74e91da446d6f9e894e3135b6f97  2008.0/i586/openssh-4.7p1-2.3mdv2008.0.i586.rpm
 32c9074f32ac7dd8fc984840c8acb6d1  2008.0/i586/openssh-askpass-4.7p1-2.3mdv2008.0.i586.rpm
 b9bab2a236c21278137259639db8fa8a  2008.0/i586/openssh-askpass-common-4.7p1-2.3mdv2008.0.i586.rpm
 393d108b1240c00220ad1b9dc0714b8e  2008.0/i586/openssh-askpass-gnome-4.7p1-2.3mdv2008.0.i586.rpm
 c0e15a413edaf5fe6a928f8b6768be89  2008.0/i586/openssh-clients-4.7p1-2.3mdv2008.0.i586.rpm
 1842ee4e60d22d98e9dfa3df8c217ad2  2008.0/i586/openssh-server-4.7p1-2.3mdv2008.0.i586.rpm 
 70c9befdfac13b13e875cf28d1a4b20d  2008.0/SRPMS/openssh-4.7p1-2.3mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 1f944839aa880524ae6b0397e938ca60  2008.0/x86_64/openssh-4.7p1-2.3mdv2008.0.x86_64.rpm
 9110212034c355a7b1aed824f24b0cd2  2008.0/x86_64/openssh-askpass-4.7p1-2.3mdv2008.0.x86_64.rpm
 cc1751f3b90e1fe0a2324c32291c6db1  2008.0/x86_64/openssh-askpass-common-4.7p1-2.3mdv2008.0.x86_64.rpm
 2b3e84eddd18300eec8678c22f4c6405  2008.0/x86_64/openssh-askpass-gnome-4.7p1-2.3mdv2008.0.x86_64.rpm
 bc7ad105ab14f63baeb98443583b311c  2008.0/x86_64/openssh-clients-4.7p1-2.3mdv2008.0.x86_64.rpm
 7ca607d434d83e127123e7e8ec6d1c61  2008.0/x86_64/openssh-server-4.7p1-2.3mdv2008.0.x86_64.rpm 
 70c9befdfac13b13e875cf28d1a4b20d  2008.0/SRPMS/openssh-4.7p1-2.3mdv2008.0.src.rpm

 Mandriva Linux 2008.1:
 2400784116e037ec9f6864c6e0a84039  2008.1/i586/openssh-4.7p1-9.1mdv2008.1.i586.rpm
 461526e375087387d6d46c4413e54a99  2008.1/i586/openssh-askpass-4.7p1-9.1mdv2008.1.i586.rpm
 b42eb4cd2e66cad2a3e610458e3d25a9  2008.1/i586/openssh-askpass-common-4.7p1-9.1mdv2008.1.i586.rpm
 70ddcfc089436570c498693222248ecb  2008.1/i586/openssh-askpass-gnome-4.7p1-9.1mdv2008.1.i586.rpm
 43148a16687a9fe1426e4e1831bbb522  2008.1/i586/openssh-clients-4.7p1-9.1mdv2008.1.i586.rpm
 6ef013aabf5d4e46ade484723ca21874  2008.1/i586/openssh-server-4.7p1-9.1mdv2008.1.i586.rpm 
 4aee9693056b28dc290eddb82d18d9a1  2008.1/SRPMS/openssh-4.7p1-9.1mdv2008.1.src.rpm

 Mandriva Linux 2008.1/X86_64:
 99f925a96953943b0379971f50c7e809  2008.1/x86_64/openssh-4.7p1-9.1mdv2008.1.x86_64.rpm
 a5c1fc99eb774cebacfa86c9c8670cd7  2008.1/x86_64/openssh-askpass-4.7p1-9.1mdv2008.1.x86_64.rpm
 d41cea3f2f26c4a0f7669097465c289a  2008.1/x86_64/openssh-askpass-common-4.7p1-9.1mdv2008.1.x86_64.rpm
 eadfa5c68e192b032dc401835c409b61  2008.1/x86_64/openssh-askpass-gnome-4.7p1-9.1mdv2008.1.x86_64.rpm
 a3e1001bae15500f892724d1dab797ed  2008.1/x86_64/openssh-clients-4.7p1-9.1mdv2008.1.x86_64.rpm
 ebb79e86c2428367a967d210ccd197d6  2008.1/x86_64/openssh-server-4.7p1-9.1mdv2008.1.x86_64.rpm 
 4aee9693056b28dc290eddb82d18d9a1  2008.1/SRPMS/openssh-4.7p1-9.1mdv2008.1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFIIMfCmqjQ0CJFipgRAsvXAJ43hthPWw77ThUQbEySBoszK7yI8gCg7i1H
O249fnGInw9vUIhIU/qE880=
=Q3QA
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/