Updated OpenSSH packages available

Updated OpenSSH packages are now available for Red Hat Linux 7, 7.1, and
7.2. These updates fix a bug in handling of restricted keys which may
allow users to bypass command restrictions by using subsystems and a subtle
bug which might aid a passive analysis attack.

OpenSSH versions prior to 2.9.9, when configured to provide sftp access
using the subsystem feature, allows remote authenticated users to bypass
authorized_keys2 "command=" restrictions by using sftp commands.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2001-0816 to this issue.

OpenSSH 2.9 also contained a subtle bug in the routines which attempt to
confound an attacker using passive analysis, which would cause it to send
two confounding packets instead of one when a client finished sending it a
password.

Red Hat would like to thank Solar Designer and Markus Friedl for assisting
with the patches.

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains the
desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0816
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0816
http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=100156674610824&w=2

commands, echo, openssh, restricted