news 28 Posted April 4, 2008 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] openssh (SSA:2008-095-01) New openssh packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, and -current to fix a security issue. More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1483 Here are the details from the Slackware 12.0 ChangeLog: +--------------------------+ patches/packages/openssh-5.0p1-i486-1_slack12.0.tgz: Upgraded to openssh-5.0p1. This version fixes a security issue where local users could hijack forwarded X connections. Upgrading to the new package is highly recommended. For more information on this security issue, please see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1483 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ HINT: Getting slow download speeds from ftp.slackware.com? Give slackware.osuosl.org a try. This is another primary FTP site for Slackware that can be considerably faster than downloading directly from ftp.slackware.com. Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating additional FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you. Updated package for Slackware 8.1: ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/openssh-5.0p1-i386-1_slack8.1.tgz Updated package for Slackware 9.0: ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/openssh-5.0p1-i386-1_slack9.0.tgz Updated package for Slackware 9.1: ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/openssh-5.0p1-i486-1_slack9.1.tgz Updated package for Slackware 10.0: ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/openssh-5.0p1-i486-1_slack10.0.tgz Updated package for Slackware 10.1: ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/openssh-5.0p1-i486-1_slack10.1.tgz Updated package for Slackware 10.2: ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/openssh-5.0p1-i486-1_slack10.2.tgz Updated package for Slackware 11.0: ftp://ftp.slackware.com/pub/slackware/slackware-11.0/patches/packages/openssh-5.0p1-i486-1_slack11.0.tgz Updated package for Slackware 12.0: ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/openssh-5.0p1-i486-1_slack12.0.tgz Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/openssh-5.0p1-i486-1.tgz MD5 signatures: +-------------+ Slackware 8.1 package: 4a0e0f2293c98fd4ecb2049da7d6c0e7 openssh-5.0p1-i386-1_slack8.1.tgz Slackware 9.0 package: c3e5e085a32c916517badda0ade062d6 openssh-5.0p1-i386-1_slack9.0.tgz Slackware 9.1 package: 375d94c11692403d4ee5b4b051a21610 openssh-5.0p1-i486-1_slack9.1.tgz Slackware 10.0 package: 4aba1ec2f602618ffdcbde3b249fb05f openssh-5.0p1-i486-1_slack10.0.tgz Slackware 10.1 package: b0edcc0ef8a2de1a14c5492a04fdd931 openssh-5.0p1-i486-1_slack10.1.tgz Slackware 10.2 package: 0335153a90308f17d83c0e3c24ccd9ee openssh-5.0p1-i486-1_slack10.2.tgz Slackware 11.0 package: e675ba53b97892063ea77b4dfa80dce9 openssh-5.0p1-i486-1_slack11.0.tgz Slackware 12.0 package: 0712943ea51957cefa9c53d7f74f12e4 openssh-5.0p1-i486-1_slack12.0.tgz Slackware -current package: 0d22d793f4ce2ab68e9a9b5e9b893e3c openssh-5.0p1-i486-1.tgz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg openssh-5.0p1-i486-1_slack12.0.tgz IMPORTANT NOTE: Before restarting sshd (if you use it), be sure to move any new /etc/rc.d/rc.sshd into place: mv /etc/rc.d/rc.sshd.new /etc/rc.d/rc.sshd Then, make sure that the permissions are correct -- executable if you want sshd to start at boot, non-executable otherwise. Finally, restart sshd: sh /etc/rc.d/rc.sshd restart This will restart the listener process so that all new connections to sshd will connect to the new sshd, while old connections will not be dropped (and may be insecure until they are disconnected and reattached). Any users who are forwarding X connections through ssh should drop their connection and log in again. +-----+ Slackware Linux Security Team http://slackware.com/gpg-key security ( -at -) slackware.com +------------------------------------------------------------------------+ Share this post Link to post
