Message-ID: <20081001223103.GJ12527@outflux.net>
Date: Wed, 1 Oct 2008 15:31:03 -0700
From: Kees Cook <kees@...ntu.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [USN-649-1] OpenSSH vulnerabilities

===========================================================
Ubuntu Security Notice USN-649-1           October 01, 2008
openssh vulnerabilities
CVE-2008-1657, CVE-2008-4109
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 7.04
Ubuntu 7.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
  openssh-server                  1:4.2p1-7ubuntu3.5

Ubuntu 7.04:
  openssh-server                  1:4.3p2-8ubuntu1.5

Ubuntu 7.10:
  openssh-server                  1:4.6p1-5ubuntu0.6

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

It was discovered that the ForceCommand directive could be bypassed.
If a local user created a malicious ~/.ssh/rc file, they could execute
arbitrary commands as their user id.  This only affected Ubuntu 7.10.
(CVE-2008-1657)

USN-355-1 fixed vulnerabilities in OpenSSH.  It was discovered that the
fixes for this issue were incomplete.  A remote attacker could attempt
multiple logins, filling all available connection slots, leading to a
denial of service.  This only affected Ubuntu 6.06 and 7.04.
(CVE-2008-4109)


Updated packages for Ubuntu 6.06 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.2p1-7ubuntu3.5.diff.gz
      Size/MD5:   182759 84d6f01556b7f178854b1d89290f75a0
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.2p1-7ubuntu3.5.dsc
      Size/MD5:     1049 4493dda5817b846d33120f85c6d3f77b
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.2p1.orig.tar.gz
      Size/MD5:   928420 93295701e6bcd76fabd6a271654ed15c

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh_4.2p1-7ubuntu3.5_all.deb
      Size/MD5:     1058 1c1b30301624bd73f969ff494e1836a0

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.2p1-7ubuntu3.5_amd64.udeb
      Size/MD5:   166424 3916923233fa947bdf27caa2b0ad865f
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.2p1-7ubuntu3.5_amd64.deb
      Size/MD5:   655784 64c58ef16131c62ee1e2b0ebb6132baf
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.2p1-7ubuntu3.5_amd64.deb
      Size/MD5:   237226 30efa65f590c97098227165f8ce0d918
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.2p1-7ubuntu3.5_amd64.deb
      Size/MD5:    87378 20d6b56fe548f0a9104b092df38570f6
    http://security.ubuntu.com/ubuntu/pool/universe/o/openssh/openssh-server-udeb_4.2p1-7ubuntu3.5_amd64.udeb
      Size/MD5:   183792 04ddb7fb9361354ba35b0a7a4989ba9b

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.2p1-7ubuntu3.5_i386.udeb
      Size/MD5:   141086 9411d7c548f6b5d7c8b42229135905c7
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.2p1-7ubuntu3.5_i386.deb
      Size/MD5:   576638 ab0c266e0ced4ae835960da96ad1827e
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.2p1-7ubuntu3.5_i386.deb
      Size/MD5:   207402 8ba8438b3ac1a8b8a59fb1ea45ff43db
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.2p1-7ubuntu3.5_i386.deb
      Size/MD5:    87034 eacfbe472a92433cc8797d5859d1593d
    http://security.ubuntu.com/ubuntu/pool/universe/o/openssh/openssh-server-udeb_4.2p1-7ubuntu3.5_i386.udeb
      Size/MD5:   153712 3f140bf92b5403618c06ee590a4a0873

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.2p1-7ubuntu3.5_powerpc.udeb
      Size/MD5:   160032 47466e95a8099a8a569ef6d546144ba1
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.2p1-7ubuntu3.5_powerpc.deb
      Size/MD5:   641064 a7a51b8deb7b031b3fd87d059d9b5482
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.2p1-7ubuntu3.5_powerpc.deb
      Size/MD5:   228208 fd847956aa785ff2b962dedd22374022
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.2p1-7ubuntu3.5_powerpc.deb
      Size/MD5:    88664 1e45f98265cc3637b1046313065728ca
    http://security.ubuntu.com/ubuntu/pool/universe/o/openssh/openssh-server-udeb_4.2p1-7ubuntu3.5_powerpc.udeb
      Size/MD5:   168970 24ccb68ea276db25f2b32426dd5c6254

  sparc architecture (Sun SPARC/UltraSPARC):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.2p1-7ubuntu3.5_sparc.udeb
      Size/MD5:   150252 6545ef0a6d40c8d249ffd41c6b5bc4f3
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.2p1-7ubuntu3.5_sparc.deb
      Size/MD5:   584012 fde05cab33342416c9022540422da448
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.2p1-7ubuntu3.5_sparc.deb
      Size/MD5:   210432 e853f6e07fe6164b30f86d88600d74ca
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.2p1-7ubuntu3.5_sparc.deb
      Size/MD5:    87058 6bc705d12536e6e05fce90f8b915eb29
    http://security.ubuntu.com/ubuntu/pool/universe/o/openssh/openssh-server-udeb_4.2p1-7ubuntu3.5_sparc.udeb
      Size/MD5:   163174 f4d91d5df6312dc145802bc569515b08

Updated packages for Ubuntu 7.04:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.3p2-8ubuntu1.5.diff.gz
      Size/MD5:   277584 b9cdd02d7d880ac3e95342e933fb9734
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.3p2-8ubuntu1.5.dsc
      Size/MD5:     1120 22c0d5f9c2c5e80d0faff7e5060b93e2
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.3p2.orig.tar.gz
      Size/MD5:   920186 239fc801443acaffd4c1f111948ee69c

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh_4.3p2-8ubuntu1.5_all.deb
      Size/MD5:     1086 35b8dc75cb62b2ab9a01efcf9b5364d3
    http://security.ubuntu.com/ubuntu/pool/universe/o/openssh/ssh-krb5_4.3p2-8ubuntu1.5_all.deb
      Size/MD5:    93576 0e9d1015896f3c3c827fb8cc33e2968f

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.3p2-8ubuntu1.5_amd64.udeb
      Size/MD5:   173014 04f0dd2312772fcf12de99fec6597bda
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.3p2-8ubuntu1.5_amd64.deb
      Size/MD5:   739970 2128e70e5ec789ae362d713835dceb78
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.3p2-8ubuntu1.5_amd64.udeb
      Size/MD5:   185880 be6c4e13e999263b7ad2612a290f424a
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.3p2-8ubuntu1.5_amd64.deb
      Size/MD5:   255666 e4a9dad306c9f93a5df4b95659813531
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.3p2-8ubuntu1.5_amd64.deb
      Size/MD5:   101964 1a3d54cb2a88366ffdc8f92355684c0c

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.3p2-8ubuntu1.5_i386.udeb
      Size/MD5:   156802 dd5314071ffb46c1f94b13c6d774d7bc
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.3p2-8ubuntu1.5_i386.deb
      Size/MD5:   702048 322c7cb00e1b85d57a83e952068176ca
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.3p2-8ubuntu1.5_i386.udeb
      Size/MD5:   165482 661e2a9f1029a914f61d05b2d4b2d472
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.3p2-8ubuntu1.5_i386.deb
      Size/MD5:   238106 061297057a0d7676244b7f95c65b8c83
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.3p2-8ubuntu1.5_i386.deb
      Size/MD5:   101672 40fd4b7a5bc494e78cb2905d6dcbbe07

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.3p2-8ubuntu1.5_powerpc.udeb
      Size/MD5:   178906 9424fda98723e8998dbec4711628064a
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.3p2-8ubuntu1.5_powerpc.deb
      Size/MD5:   767896 b8f33e286a682417653382421bd1ecaf
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.3p2-8ubuntu1.5_powerpc.udeb
      Size/MD5:   184086 f68b5556e452d11113d750080625252c
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.3p2-8ubuntu1.5_powerpc.deb
      Size/MD5:   259758 60a337703875ab4aa889de98e32ce10e
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.3p2-8ubuntu1.5_powerpc.deb
      Size/MD5:   104420 9a7d82f1f4b99ad3612300684f9f5f29

  sparc architecture (Sun SPARC/UltraSPARC):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.3p2-8ubuntu1.5_sparc.udeb
      Size/MD5:   164290 f270344795f84733794562d0dedd93e4
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.3p2-8ubuntu1.5_sparc.deb
      Size/MD5:   751908 2dc3dddc0015ad14b0a52f56c6acb6cd
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.3p2-8ubuntu1.5_sparc.udeb
      Size/MD5:   172644 b50ae3ba357245b5f5ebd0b3baa73982
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.3p2-8ubuntu1.5_sparc.deb
      Size/MD5:   263454 fd4a6846b03b1bc9b04a25f6f49e982e
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.3p2-8ubuntu1.5_sparc.deb
      Size/MD5:   101908 7d6a07fc7f38be3ee4938e351fa14c02

Updated packages for Ubuntu 7.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.6p1-5ubuntu0.6.diff.gz
      Size/MD5:   200449 61de534dbe96faf221a793adf2d48cc4
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.6p1-5ubuntu0.6.dsc
      Size/MD5:     1215 232962cedc8d66f4c390eeb110271a16
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_4.6p1.orig.tar.gz
      Size/MD5:   946439 cee58cd226138191561fa2d484e18f49

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh_4.6p1-5ubuntu0.6_all.deb
      Size/MD5:     1092 c5dc097d458b1e88b09a42890c5b9ba8
    http://security.ubuntu.com/ubuntu/pool/universe/o/openssh/ssh-krb5_4.6p1-5ubuntu0.6_all.deb
      Size/MD5:    80770 9eedf328da0212f39303924f06bfa241

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.6p1-5ubuntu0.6_amd64.udeb
      Size/MD5:   176418 18fa5b9f0b115082f42e8394f348182e
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.6p1-5ubuntu0.6_amd64.deb
      Size/MD5:   747234 86b643092fc58b4296450dd57bff2263
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.6p1-5ubuntu0.6_amd64.udeb
      Size/MD5:   193374 232089e72d8233317b504ce351366c66
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.6p1-5ubuntu0.6_amd64.deb
      Size/MD5:   268766 3dd934f2eae20ee1e532cd72b452e846
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.6p1-5ubuntu0.6_amd64.deb
      Size/MD5:    88934 653d12aab773e3ef6dc36ce2dde26aef

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.6p1-5ubuntu0.6_i386.udeb
      Size/MD5:   158798 96b9e3411a9d36e5d0666fa3c7d7cabe
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.6p1-5ubuntu0.6_i386.deb
      Size/MD5:   706288 3fd8dd728a81af02944b4e939031c3cf
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.6p1-5ubuntu0.6_i386.udeb
      Size/MD5:   171688 9549e26eea9999ffc740f0a129e33a57
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.6p1-5ubuntu0.6_i386.deb
      Size/MD5:   249754 94282f20bd4aa7396a75023e82165747
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.6p1-5ubuntu0.6_i386.deb
      Size/MD5:    88574 a21161382d91858fac7717dd559a600f

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/o/openssh/openssh-client-udeb_4.6p1-5ubuntu0.6_lpia.udeb
      Size/MD5:   158796 dbafbeb828cb60792a06828574bde543
    http://ports.ubuntu.com/pool/main/o/openssh/openssh-client_4.6p1-5ubuntu0.6_lpia.deb
      Size/MD5:   676846 6c4abc9c511c2d7d203bc655f66932d8
    http://ports.ubuntu.com/pool/main/o/openssh/openssh-server-udeb_4.6p1-5ubuntu0.6_lpia.udeb
      Size/MD5:   171198 0979246745cbf49b519a904fd585d32d
    http://ports.ubuntu.com/pool/main/o/openssh/openssh-server_4.6p1-5ubuntu0.6_lpia.deb
      Size/MD5:   242990 cae913c813b2e9948c2894eae93b204c
    http://ports.ubuntu.com/pool/main/o/openssh/ssh-askpass-gnome_4.6p1-5ubuntu0.6_lpia.deb
      Size/MD5:    88578 415771b80a67c476687afd44b39668e7

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.6p1-5ubuntu0.6_powerpc.udeb
      Size/MD5:   180856 3de38375b673254f18483447c101ac24
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.6p1-5ubuntu0.6_powerpc.deb
      Size/MD5:   774458 6af53781bb77d958a18910a127ed0fb5
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.6p1-5ubuntu0.6_powerpc.udeb
      Size/MD5:   190268 14095d3c2485b9de89bf212c6db9169f
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.6p1-5ubuntu0.6_powerpc.deb
      Size/MD5:   272016 11e268a96f7fc40092756936a3be8985
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.6p1-5ubuntu0.6_powerpc.deb
      Size/MD5:    91288 cd791401f890b1744da17fa79bbbf4df

  sparc architecture (Sun SPARC/UltraSPARC):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client-udeb_4.6p1-5ubuntu0.6_sparc.udeb
      Size/MD5:   166884 7b18ae280832b6ce1e647f7d09ec36da
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-client_4.6p1-5ubuntu0.6_sparc.deb
      Size/MD5:   759194 51c560a53b4ef0557619fb0551e76d73
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server-udeb_4.6p1-5ubuntu0.6_sparc.udeb
      Size/MD5:   179110 4611135c98179208dfe5f2eca65f12d1
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-server_4.6p1-5ubuntu0.6_sparc.deb
      Size/MD5:   276582 fce6141489be0312c10fb7f837542dbe
    http://security.ubuntu.com/ubuntu/pool/main/o/openssh/ssh-askpass-gnome_4.6p1-5ubuntu0.6_sparc.deb
      Size/MD5:    88890 113d0661557999b588060a9d35e75ed8


Download attachment "signature.asc" of type "application/pgp-signature" (236 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists