Skip to navigation

Security Advisory Low: openssh security and bug fix update

Advisory: RHSA-2007:0257-7
Type: Security Advisory
Severity: Low
Issued on: 2007-05-01
Last updated on: 2007-05-01
Affected Products: Red Hat Desktop (v. 4)
Red Hat Enterprise Linux AS (v. 4)
Red Hat Enterprise Linux ES (v. 4)
Red Hat Enterprise Linux WS (v. 4)
CVEs (cve.mitre.org): CVE-2005-2666

Details

Updated openssh packages that fix a security issue and various bugs are now
available.

This update has been rated as having low security impact by the Red Hat
Security Response Team.

OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. This
package includes the core files necessary for both the OpenSSH client and
server.

OpenSSH stores hostnames, IP addresses, and keys in plaintext in the
known_hosts file. A local attacker that has already compromised a user's
SSH account could use this information to generate a list of additional
targets that are likely to have the same password or key. (CVE-2005-2666)

The following bugs have also been fixed in this update:

* The ssh client could abort the running connection when the server
application generated a large output at once.

* When 'X11UseLocalhost' option was set to 'no' on systems with IPv6
networking enabled, the X11 forwarding socket listened only for IPv6
connections.

* When the privilege separation was enabled in /etc/ssh/sshd_config, some
log messages in the system log were duplicated and also had timestamps from
an incorrect timezone.

All users of openssh should upgrade to these updated packages, which
contain backported patches to correct these issues.


Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Updated packages

Red Hat Desktop (v. 4)

SRPMS:
openssh-3.9p1-8.RHEL4.20.src.rpm
File outdated by:  RHEA-2010:0511
    MD5: 73cd43ad99e6b5eb626914bb65f11d70
 
IA-32:
openssh-3.9p1-8.RHEL4.20.i386.rpm
File outdated by:  RHEA-2010:0511
    MD5: 355fb0d34d1207f6629f886f8cf3e6c4
openssh-askpass-3.9p1-8.RHEL4.20.i386.rpm
File outdated by:  RHEA-2010:0511
    MD5: 5b062f94d91ed8418c45745d8b285bd4
openssh-askpass-gnome-3.9p1-8.RHEL4.20.i386.rpm
File outdated by:  RHEA-2010:0511
    MD5: 4c13962301e5f93492fcb02b7f01a7b1
openssh-clients-3.9p1-8.RHEL4.20.i386.rpm
File outdated by:  RHEA-2010:0511
    MD5: 029fa6c52dec14626a1e443caecc2300
openssh-server-3.9p1-8.RHEL4.20.i386.rpm
File outdated by:  RHEA-2010:0511
    MD5: 74c1c9b1293e8e46ecaf46db181d3a1b
 
x86_64:
openssh-3.9p1-8.RHEL4.20.x86_64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 61cd0299d5413094af7970856f7fffc8
openssh-askpass-3.9p1-8.RHEL4.20.x86_64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 88464fef4b7393f7f081dc0c734bcd53
openssh-askpass-gnome-3.9p1-8.RHEL4.20.x86_64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 198d98b530ce9fbfe6dd6b3d3b38712c
openssh-clients-3.9p1-8.RHEL4.20.x86_64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 1c3c86136815400a0713187d9f55315b
openssh-server-3.9p1-8.RHEL4.20.x86_64.rpm
File outdated by:  RHEA-2010:0511
    MD5: e6b172814bfc7402996bf498a8f37634
 
Red Hat Enterprise Linux AS (v. 4)

SRPMS:
openssh-3.9p1-8.RHEL4.20.src.rpm
File outdated by:  RHEA-2010:0511
    MD5: 73cd43ad99e6b5eb626914bb65f11d70
 
IA-32:
openssh-3.9p1-8.RHEL4.20.i386.rpm
File outdated by:  RHEA-2010:0511
    MD5: 355fb0d34d1207f6629f886f8cf3e6c4
openssh-askpass-3.9p1-8.RHEL4.20.i386.rpm
File outdated by:  RHEA-2010:0511
    MD5: 5b062f94d91ed8418c45745d8b285bd4
openssh-askpass-gnome-3.9p1-8.RHEL4.20.i386.rpm
File outdated by:  RHEA-2010:0511
    MD5: 4c13962301e5f93492fcb02b7f01a7b1
openssh-clients-3.9p1-8.RHEL4.20.i386.rpm
File outdated by:  RHEA-2010:0511
    MD5: 029fa6c52dec14626a1e443caecc2300
openssh-server-3.9p1-8.RHEL4.20.i386.rpm
File outdated by:  RHEA-2010:0511
    MD5: 74c1c9b1293e8e46ecaf46db181d3a1b
 
IA-64:
openssh-3.9p1-8.RHEL4.20.ia64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 063a012cb911cad11e1c6e1f700e46ab
openssh-askpass-3.9p1-8.RHEL4.20.ia64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 67a3c8ab28bdcefe7b2fb957c933b996
openssh-askpass-gnome-3.9p1-8.RHEL4.20.ia64.rpm
File outdated by:  RHEA-2010:0511
    MD5: ce81cfbef39e88997fd9084f04f46f26
openssh-clients-3.9p1-8.RHEL4.20.ia64.rpm
File outdated by:  RHEA-2010:0511
    MD5: c7bd82bac6e899e197ce59d4dc061d07
openssh-server-3.9p1-8.RHEL4.20.ia64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 9110321bf599bf3f29eaccaa32b7ce1d
 
PPC:
openssh-3.9p1-8.RHEL4.20.ppc.rpm
File outdated by:  RHEA-2010:0511
    MD5: cac15ade9405e8ef47939842656b6f70
openssh-askpass-3.9p1-8.RHEL4.20.ppc.rpm
File outdated by:  RHEA-2010:0511
    MD5: 783a2f6121f3a7373e5f7d7048f95ecd
openssh-askpass-gnome-3.9p1-8.RHEL4.20.ppc.rpm
File outdated by:  RHEA-2010:0511
    MD5: 2571d5eb1f66180cf8eebc281d7a41bd
openssh-clients-3.9p1-8.RHEL4.20.ppc.rpm
File outdated by:  RHEA-2010:0511
    MD5: 195d880c6af6314c807fd74249bc494c
openssh-server-3.9p1-8.RHEL4.20.ppc.rpm
File outdated by:  RHEA-2010:0511
    MD5: 5bac6e49005be5b599254ab40e6582f1
 
s390:
openssh-3.9p1-8.RHEL4.20.s390.rpm
File outdated by:  RHEA-2010:0511
    MD5: 7f2a4d71dde9957902770b5a8cbebb98
openssh-askpass-3.9p1-8.RHEL4.20.s390.rpm
File outdated by:  RHEA-2010:0511
    MD5: 6a768d4d2fb313e8e9536854f8980cff
openssh-askpass-gnome-3.9p1-8.RHEL4.20.s390.rpm
File outdated by:  RHEA-2010:0511
    MD5: e0eed1c1b158d2b9f4265931ddfec2df
openssh-clients-3.9p1-8.RHEL4.20.s390.rpm
File outdated by:  RHEA-2010:0511
    MD5: d776bccdb065c52fee0820c2452e7909
openssh-server-3.9p1-8.RHEL4.20.s390.rpm
File outdated by:  RHEA-2010:0511
    MD5: 05f4d043e3fd7993e041ac8af1954ffd
 
s390x:
openssh-3.9p1-8.RHEL4.20.s390x.rpm
File outdated by:  RHEA-2010:0511
    MD5: ee4dd7366a973d0cc074397ab44b3d36
openssh-askpass-3.9p1-8.RHEL4.20.s390x.rpm
File outdated by:  RHEA-2010:0511
    MD5: e521ced488fc72105e1591653855cfa0
openssh-askpass-gnome-3.9p1-8.RHEL4.20.s390x.rpm
File outdated by:  RHEA-2010:0511
    MD5: b3099fded8c796a4b7a26fc9918f8694
openssh-clients-3.9p1-8.RHEL4.20.s390x.rpm
File outdated by:  RHEA-2010:0511
    MD5: 7b3894c6220efb08cd42e2ba41b97c24
openssh-server-3.9p1-8.RHEL4.20.s390x.rpm
File outdated by:  RHEA-2010:0511
    MD5: 612e6fa71dd9d0b4a0abb84af6ad0e0d
 
x86_64:
openssh-3.9p1-8.RHEL4.20.x86_64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 61cd0299d5413094af7970856f7fffc8
openssh-askpass-3.9p1-8.RHEL4.20.x86_64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 88464fef4b7393f7f081dc0c734bcd53
openssh-askpass-gnome-3.9p1-8.RHEL4.20.x86_64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 198d98b530ce9fbfe6dd6b3d3b38712c
openssh-clients-3.9p1-8.RHEL4.20.x86_64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 1c3c86136815400a0713187d9f55315b
openssh-server-3.9p1-8.RHEL4.20.x86_64.rpm
File outdated by:  RHEA-2010:0511
    MD5: e6b172814bfc7402996bf498a8f37634
 
Red Hat Enterprise Linux ES (v. 4)

SRPMS:
openssh-3.9p1-8.RHEL4.20.src.rpm
File outdated by:  RHEA-2010:0511
    MD5: 73cd43ad99e6b5eb626914bb65f11d70
 
IA-32:
openssh-3.9p1-8.RHEL4.20.i386.rpm
File outdated by:  RHEA-2010:0511
    MD5: 355fb0d34d1207f6629f886f8cf3e6c4
openssh-askpass-3.9p1-8.RHEL4.20.i386.rpm
File outdated by:  RHEA-2010:0511
    MD5: 5b062f94d91ed8418c45745d8b285bd4
openssh-askpass-gnome-3.9p1-8.RHEL4.20.i386.rpm
File outdated by:  RHEA-2010:0511
    MD5: 4c13962301e5f93492fcb02b7f01a7b1
openssh-clients-3.9p1-8.RHEL4.20.i386.rpm
File outdated by:  RHEA-2010:0511
    MD5: 029fa6c52dec14626a1e443caecc2300
openssh-server-3.9p1-8.RHEL4.20.i386.rpm
File outdated by:  RHEA-2010:0511
    MD5: 74c1c9b1293e8e46ecaf46db181d3a1b
 
IA-64:
openssh-3.9p1-8.RHEL4.20.ia64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 063a012cb911cad11e1c6e1f700e46ab
openssh-askpass-3.9p1-8.RHEL4.20.ia64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 67a3c8ab28bdcefe7b2fb957c933b996
openssh-askpass-gnome-3.9p1-8.RHEL4.20.ia64.rpm
File outdated by:  RHEA-2010:0511
    MD5: ce81cfbef39e88997fd9084f04f46f26
openssh-clients-3.9p1-8.RHEL4.20.ia64.rpm
File outdated by:  RHEA-2010:0511
    MD5: c7bd82bac6e899e197ce59d4dc061d07
openssh-server-3.9p1-8.RHEL4.20.ia64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 9110321bf599bf3f29eaccaa32b7ce1d
 
x86_64:
openssh-3.9p1-8.RHEL4.20.x86_64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 61cd0299d5413094af7970856f7fffc8
openssh-askpass-3.9p1-8.RHEL4.20.x86_64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 88464fef4b7393f7f081dc0c734bcd53
openssh-askpass-gnome-3.9p1-8.RHEL4.20.x86_64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 198d98b530ce9fbfe6dd6b3d3b38712c
openssh-clients-3.9p1-8.RHEL4.20.x86_64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 1c3c86136815400a0713187d9f55315b
openssh-server-3.9p1-8.RHEL4.20.x86_64.rpm
File outdated by:  RHEA-2010:0511
    MD5: e6b172814bfc7402996bf498a8f37634
 
Red Hat Enterprise Linux WS (v. 4)

SRPMS:
openssh-3.9p1-8.RHEL4.20.src.rpm
File outdated by:  RHEA-2010:0511
    MD5: 73cd43ad99e6b5eb626914bb65f11d70
 
IA-32:
openssh-3.9p1-8.RHEL4.20.i386.rpm
File outdated by:  RHEA-2010:0511
    MD5: 355fb0d34d1207f6629f886f8cf3e6c4
openssh-askpass-3.9p1-8.RHEL4.20.i386.rpm
File outdated by:  RHEA-2010:0511
    MD5: 5b062f94d91ed8418c45745d8b285bd4
openssh-askpass-gnome-3.9p1-8.RHEL4.20.i386.rpm
File outdated by:  RHEA-2010:0511
    MD5: 4c13962301e5f93492fcb02b7f01a7b1
openssh-clients-3.9p1-8.RHEL4.20.i386.rpm
File outdated by:  RHEA-2010:0511
    MD5: 029fa6c52dec14626a1e443caecc2300
openssh-server-3.9p1-8.RHEL4.20.i386.rpm
File outdated by:  RHEA-2010:0511
    MD5: 74c1c9b1293e8e46ecaf46db181d3a1b
 
IA-64:
openssh-3.9p1-8.RHEL4.20.ia64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 063a012cb911cad11e1c6e1f700e46ab
openssh-askpass-3.9p1-8.RHEL4.20.ia64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 67a3c8ab28bdcefe7b2fb957c933b996
openssh-askpass-gnome-3.9p1-8.RHEL4.20.ia64.rpm
File outdated by:  RHEA-2010:0511
    MD5: ce81cfbef39e88997fd9084f04f46f26
openssh-clients-3.9p1-8.RHEL4.20.ia64.rpm
File outdated by:  RHEA-2010:0511
    MD5: c7bd82bac6e899e197ce59d4dc061d07
openssh-server-3.9p1-8.RHEL4.20.ia64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 9110321bf599bf3f29eaccaa32b7ce1d
 
x86_64:
openssh-3.9p1-8.RHEL4.20.x86_64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 61cd0299d5413094af7970856f7fffc8
openssh-askpass-3.9p1-8.RHEL4.20.x86_64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 88464fef4b7393f7f081dc0c734bcd53
openssh-askpass-gnome-3.9p1-8.RHEL4.20.x86_64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 198d98b530ce9fbfe6dd6b3d3b38712c
openssh-clients-3.9p1-8.RHEL4.20.x86_64.rpm
File outdated by:  RHEA-2010:0511
    MD5: 1c3c86136815400a0713187d9f55315b
openssh-server-3.9p1-8.RHEL4.20.x86_64.rpm
File outdated by:  RHEA-2010:0511
    MD5: e6b172814bfc7402996bf498a8f37634
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

162681 - CVE-2005-2666 openssh vulnerable to known_hosts address harvesting
184357 - buffer_append_space: alloc not supported Error
193710 - [PATCH] audit patch for openssh missing #include "loginrec.h" in auth.c
201594 - sshd does not create ipv4 listen socket for X11 forwarding
203671 - additional (time skewed) log entries in /var/log/secure since U4


References


Keywords

buffer, forwarding, IPv6, length, syslog, X11


These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/