[Security Announce] [ MDVSA-2008:098 ] - Updated openssh packages fix vulnerability

[news 28]

This is a multi-part message in MIME format...

 

------------=_1210119040-11275-4038

 

 

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

_______________________________________________________________________

 

Mandriva Linux Security Advisory MDVSA-2008:098

http://www.mandriva.com/security/

_______________________________________________________________________

 

Package : openssh

Date : May 6, 2008

Affected: 2007.1, 2008.0, 2008.1

_______________________________________________________________________

 

Problem Description:

 

A vulnerability in OpenSSH 4.4 through 4.8 allowed local attackers

to bypass intended security restrictions enabling them to execute

commands other than those specified by the ForceCommand directive,

provided they are able to modify to ~/.ssh/rc (CVE-2008-1657).

 

The updated packages have been patched to correct this issue.

_______________________________________________________________________

 

References:

 

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1657

_______________________________________________________________________

 

Updated Packages:

 

Mandriva Linux 2007.1:

08f6f5bdd307e17c510aa5d100f91ef3 2007.1/i586/openssh-4.6p1-1.3mdv2007.1.i586.rpm

235d55d80b04e360e8d7c5fa94633251 2007.1/i586/openssh-askpass-4.6p1-1.3mdv2007.1.i586.rpm

09d544148faf91e07782b663f7010e51 2007.1/i586/openssh-askpass-common-4.6p1-1.3mdv2007.1.i586.rpm

379538dd86330b4577ee785bcd565962 2007.1/i586/openssh-askpass-gnome-4.6p1-1.3mdv2007.1.i586.rpm

e6e85335d7d25e0fd51eaaeedfe8c02a 2007.1/i586/openssh-clients-4.6p1-1.3mdv2007.1.i586.rpm

b9ef64c7c673c831dd06ad2191f9c5d7 2007.1/i586/openssh-server-4.6p1-1.3mdv2007.1.i586.rpm

8ea0e336e89c8f2c5a2cc777354a4705 2007.1/SRPMS/openssh-4.6p1-1.3mdv2007.1.src.rpm

 

Mandriva Linux 2007.1/X86_64:

3c021dffbaa950e10efeefcc5b286fef 2007.1/x86_64/openssh-4.6p1-1.3mdv2007.1.x86_64.rpm

ad92d84d606f22f49fa95576d46d3870 2007.1/x86_64/openssh-askpass-4.6p1-1.3mdv2007.1.x86_64.rpm

61aacfe978daa0447306778ed77cc5f0 2007.1/x86_64/openssh-askpass-common-4.6p1-1.3mdv2007.1.x86_64.rpm

ad2a37a51549e8d06a0bfc1c71642d46 2007.1/x86_64/openssh-askpass-gnome-4.6p1-1.3mdv2007.1.x86_64.rpm

d21605f50fc092f4e8a003a3a6cebaae 2007.1/x86_64/openssh-clients-4.6p1-1.3mdv2007.1.x86_64.rpm

829c6e69c77c06653859e0106f80dece 2007.1/x86_64/openssh-server-4.6p1-1.3mdv2007.1.x86_64.rpm

8ea0e336e89c8f2c5a2cc777354a4705 2007.1/SRPMS/openssh-4.6p1-1.3mdv2007.1.src.rpm

 

Mandriva Linux 2008.0:

1eac74e91da446d6f9e894e3135b6f97 2008.0/i586/openssh-4.7p1-2.3mdv2008.0.i586.rpm

32c9074f32ac7dd8fc984840c8acb6d1 2008.0/i586/openssh-askpass-4.7p1-2.3mdv2008.0.i586.rpm

b9bab2a236c21278137259639db8fa8a 2008.0/i586/openssh-askpass-common-4.7p1-2.3mdv2008.0.i586.rpm

393d108b1240c00220ad1b9dc0714b8e 2008.0/i586/openssh-askpass-gnome-4.7p1-2.3mdv2008.0.i586.rpm

c0e15a413edaf5fe6a928f8b6768be89 2008.0/i586/openssh-clients-4.7p1-2.3mdv2008.0.i586.rpm

1842ee4e60d22d98e9dfa3df8c217ad2 2008.0/i586/openssh-server-4.7p1-2.3mdv2008.0.i586.rpm

70c9befdfac13b13e875cf28d1a4b20d 2008.0/SRPMS/openssh-4.7p1-2.3mdv2008.0.src.rpm

 

Mandriva Linux 2008.0/X86_64:

1f944839aa880524ae6b0397e938ca60 2008.0/x86_64/openssh-4.7p1-2.3mdv2008.0.x86_64.rpm

9110212034c355a7b1aed824f24b0cd2 2008.0/x86_64/openssh-askpass-4.7p1-2.3mdv2008.0.x86_64.rpm

cc1751f3b90e1fe0a2324c32291c6db1 2008.0/x86_64/openssh-askpass-common-4.7p1-2.3mdv2008.0.x86_64.rpm

2b3e84eddd18300eec8678c22f4c6405 2008.0/x86_64/openssh-askpass-gnome-4.7p1-2.3mdv2008.0.x86_64.rpm

bc7ad105ab14f63baeb98443583b311c 2008.0/x86_64/openssh-clients-4.7p1-2.3mdv2008.0.x86_64.rpm

7ca607d434d83e127123e7e8ec6d1c61 2008.0/x86_64/openssh-server-4.7p1-2.3mdv2008.0.x86_64.rpm

70c9befdfac13b13e875cf28d1a4b20d 2008.0/SRPMS/openssh-4.7p1-2.3mdv2008.0.src.rpm

 

Mandriva Linux 2008.1:

2400784116e037ec9f6864c6e0a84039 2008.1/i586/openssh-4.7p1-9.1mdv2008.1.i586.rpm

461526e375087387d6d46c4413e54a99 2008.1/i586/openssh-askpass-4.7p1-9.1mdv2008.1.i586.rpm

b42eb4cd2e66cad2a3e610458e3d25a9 2008.1/i586/openssh-askpass-common-4.7p1-9.1mdv2008.1.i586.rpm

70ddcfc089436570c498693222248ecb 2008.1/i586/openssh-askpass-gnome-4.7p1-9.1mdv2008.1.i586.rpm

43148a16687a9fe1426e4e1831bbb522 2008.1/i586/openssh-clients-4.7p1-9.1mdv2008.1.i586.rpm

6ef013aabf5d4e46ade484723ca21874 2008.1/i586/openssh-server-4.7p1-9.1mdv2008.1.i586.rpm

4aee9693056b28dc290eddb82d18d9a1 2008.1/SRPMS/openssh-4.7p1-9.1mdv2008.1.src.rpm

 

Mandriva Linux 2008.1/X86_64:

99f925a96953943b0379971f50c7e809 2008.1/x86_64/openssh-4.7p1-9.1mdv2008.1.x86_64.rpm

a5c1fc99eb774cebacfa86c9c8670cd7 2008.1/x86_64/openssh-askpass-4.7p1-9.1mdv2008.1.x86_64.rpm

d41cea3f2f26c4a0f7669097465c289a 2008.1/x86_64/openssh-askpass-common-4.7p1-9.1mdv2008.1.x86_64.rpm

eadfa5c68e192b032dc401835c409b61 2008.1/x86_64/openssh-askpass-gnome-4.7p1-9.1mdv2008.1.x86_64.rpm

a3e1001bae15500f892724d1dab797ed 2008.1/x86_64/openssh-clients-4.7p1-9.1mdv2008.1.x86_64.rpm

ebb79e86c2428367a967d210ccd197d6 2008.1/x86_64/openssh-server-4.7p1-9.1mdv2008.1.x86_64.rpm

4aee9693056b28dc290eddb82d18d9a1 2008.1/SRPMS/openssh-4.7p1-9.1mdv2008.1.src.rpm

_______________________________________________________________________

 

To upgrade automatically use MandrivaUpdate or urpmi. The verification

of md5 checksums and GPG signatures is performed automatically for you.

 

All packages are signed by Mandriva for security. You can obtain the

GPG public key of the Mandriva Security Team by executing:

 

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 

You can view other update advisories for Mandriva Linux at:

 

http://www.mandriva.com/security/advisories

 

If you want to report vulnerabilities, please contact

 

security_(at)_mandriva.com

_______________________________________________________________________

 

Type Bits/KeyID Date User ID

pub 1024D/22458A98 2000-07-10 Mandriva Security Team

 

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.9 (GNU/Linux)

 

iD8DBQFIIMfCmqjQ0CJFipgRAsvXAJ43hthPWw77ThUQbEySBoszK7yI8gCg7i1H

O249fnGInw9vUIhIU/qE880=

=Q3QA

-----END PGP SIGNATURE-----

 

 

------------=_1210119040-11275-4038

Content-Type: text/plain; name="message-footer.txt"

Content-Disposition: inline; filename="message-footer.txt"

Content-Transfer-Encoding: 8bit

 

To unsubscribe, send a email to sympa ( -at -) mandrivalinux.org

with this subject : unsubscribe security-announce

_______________________________________________________

Want to buy your Pack or Services from Mandriva?

Go to http://www.mandrivastore.com

Join the Club : http://www.mandrivaclub.com

_______________________________________________________

 

------------=_1210119040-11275-4038--