news 28 Posted August 6, 2016 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] openssh (SSA:2016-219-03) New openssh packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: +--------------------------+ patches/packages/openssh-7.3p1-i586-1_slack14.2.txz: Upgraded. This is primarily a bugfix release, and also addresses security issues. sshd(8): Mitigate a potential denial-of-service attack against the system's crypt(3) function via sshd(8). sshd(8): Mitigate timing differences in password authentication that could be used to discern valid from invalid account names when long passwords were sent and particular password hashing algorithms are in use on the server. ssh(1), sshd(8): Fix observable timing weakness in the CBC padding oracle countermeasures. ssh(1), sshd(8): Improve operation ordering of MAC verification for Encrypt-then-MAC (EtM) mode transport MAC algorithms to verify the MAC before decrypting any ciphertext. sshd(8): (portable only) Ignore PAM environment vars when UseLogin=yes. For more information, see: http://www.openssh.com/txt/release-7.3 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6210 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8325 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you. Updated package for Slackware 13.0: ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/openssh-7.3p1-i486-1_slack13.0.txz Updated package for Slackware x86_64 13.0: ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/openssh-7.3p1-x86_64-1_slack13.0.txz Updated package for Slackware 13.1: ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/openssh-7.3p1-i486-1_slack13.1.txz Updated package for Slackware x86_64 13.1: ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/openssh-7.3p1-x86_64-1_slack13.1.txz Updated package for Slackware 13.37: ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/openssh-7.3p1-i486-1_slack13.37.txz Updated package for Slackware x86_64 13.37: ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/openssh-7.3p1-x86_64-1_slack13.37.txz Updated package for Slackware 14.0: ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/openssh-7.3p1-i486-1_slack14.0.txz Updated package for Slackware x86_64 14.0: ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/openssh-7.3p1-x86_64-1_slack14.0.txz Updated package for Slackware 14.1: ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/openssh-7.3p1-i486-1_slack14.1.txz Updated package for Slackware x86_64 14.1: ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/openssh-7.3p1-x86_64-1_slack14.1.txz Updated package for Slackware 14.2: ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/openssh-7.3p1-i586-1_slack14.2.txz Updated package for Slackware x86_64 14.2: ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/openssh-7.3p1-x86_64-1_slack14.2.txz Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/openssh-7.3p1-i586-1.txz Updated package for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/openssh-7.3p1-x86_64-1.txz MD5 signatures: +-------------+ Slackware 13.0 package: 926a45f63599a8f7d559039220f2773c openssh-7.3p1-i486-1_slack13.0.txz Slackware x86_64 13.0 package: 2f18a3adf8ed54e59ac0c0740b138a67 openssh-7.3p1-x86_64-1_slack13.0.txz Slackware 13.1 package: 7f5e48238b26237b9c2542a3d34847b6 openssh-7.3p1-i486-1_slack13.1.txz Slackware x86_64 13.1 package: e277d7c7865fd46bc48ac128849d6426 openssh-7.3p1-x86_64-1_slack13.1.txz Slackware 13.37 package: 17c49c75c5d2b6ad49e0d2352fd2e922 openssh-7.3p1-i486-1_slack13.37.txz Slackware x86_64 13.37 package: 6305b5ce1ce3a4390a56c36eca6920cc openssh-7.3p1-x86_64-1_slack13.37.txz Slackware 14.0 package: 508dbde12ca36275d305ad1014f12066 openssh-7.3p1-i486-1_slack14.0.txz Slackware x86_64 14.0 package: 699e2c1d8d7383ba2137e9ead9001be2 openssh-7.3p1-x86_64-1_slack14.0.txz Slackware 14.1 package: 6a2a5dca4d9334c70239c20bfed92791 openssh-7.3p1-i486-1_slack14.1.txz Slackware x86_64 14.1 package: eb14e40f2c50beb19ccf1aaccbaf416d openssh-7.3p1-x86_64-1_slack14.1.txz Slackware 14.2 package: 624fbc40486642443292ffdaaffba640 openssh-7.3p1-i586-1_slack14.2.txz Slackware x86_64 14.2 package: c0e4d51dfb3722aa69e008389f4f089d openssh-7.3p1-x86_64-1_slack14.2.txz Slackware -current package: e9109896f7640f872e3695603579954f n/openssh-7.3p1-i586-1.txz Slackware x86_64 -current package: bcf65b51088b5b7f1dc55bab1ef63684 n/openssh-7.3p1-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg openssh-7.3p1-i586-1_slack14.2.txz Next, restart the sshd daemon: # sh /etc/rc.d/rc.sshd restart +-----+ Slackware Linux Security Team http://slackware.com/gpg-key security ( -at -) slackware.com +------------------------------------------------------------------------+ Share this post Link to post
