-----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
SuSE Security Announcement
Package: openssh
Announcement-ID: SuSE-SA:2003:038
Date: Tuesday, Sep 16 2003 22:15 MEST
Affected products: 7.2, 7.3, 8.0, 8.1, 8.2
SuSE Linux Database Server,
SuSE eMail Server III, 3.1
SuSE Linux Enterprise Server 7, 8
SuSE Linux Firewall on CD/Admin host
SuSE Linux Connectivity Server
SuSE Linux Office Server
SuSE Linux Standard Server 8
Vulnerability Type: potential remote privilege escalation
Severity (1-10): 8
SuSE default package: yes
Cross References: http://www.openssh.com/txt/buffer.adv
CERT VU#333628
CVE CAN-2003-0693
Content of this advisory:
1) security vulnerability resolved: openssh
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds:
- mysql
3) standard appendix (further information)
______________________________________________________________________________
1) problem description, brief discussion, solution, upgrade information
The openssh package is the most widely used implementation of the secure
shell protocol family (ssh). It provides a set of network connectivity
tools for remote (shell) login, designed to substitute the traditional
BSD-style r-protocols (rsh, rlogin). openssh has various authentification
mechanisms and many other features such as TCP connection and X11 display
forwarding over the fully encrypted network connection as well as file
transfer facilities.
A programming error has been found in code responsible for buffer
management. If exploited by a (remote) attacker, the error may lead to
unauthorized access to the system, allowing the execution of arbitrary
commands.
The error is known as the buffer_append_space()-bug and is assigned the
Common Vulnerabilities and Exposures (CVE) name CAN-2003-0693.
At the time of writing this announcement, it is unclear if the
buffer_append_space()-bug is exploitable. However, an increasing amount
of TCP connection attempts to port 22 (the ssh default port) has been
observed in the internet during the past days, which may indicate that
there exists an exploit for the error.
Please note that we have disabled the Privilege Separation feature in
the ssh daemon (sshd) with this update. The PrivSep feature is designed
to have parts of the ssh daemon's work running under lowered privileges,
thereby limiting the effect of a possible vulnerability in the code. The
PrivSep feature is turned on/off by the UsePrivilegeSeparation keyword
in sshd's configuration file /etc/ssh/sshd_config. The feature is held
responsible for malfunctions in PAM (Pluggable Authentification Modules).
The update mechanism will not overwrite configuration files that have
been altered after the package installation.
SPECIAL INSTALL INSTRUCTIONS:
==============================
After the update has been successfully applied, the ssh daemon (sshd)
must be restarted for update package to become effective. To restart the
ssh daemon after the update, please run the following command as root:
rcsshd restart
Please download the update package for your distribution and verify its
integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command "rpm -Fhv file.rpm" to apply
the update.
Our maintenance customers are being notified individually. The packages
are being offered to install from the maintenance web.
Intel i386 Platform:
SuSE-8.2:
ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/openssh-3.5p1-106.i586.rpm
492d66deaedcfc20c1f0d66e508db790
patch rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/openssh-3.5p1-106.i586.patch.rpm
c362fedfda79824cb40cd4e5e1055aee
source rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/openssh-3.5p1-106.src.rpm
0381b9b4818f8b669631bcab9be80fb5
SuSE-8.1:
ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/openssh-3.4p1-214.i586.rpm
dda7728501c8cf17c60eff1862922842
patch rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/openssh-3.4p1-214.i586.patch.rpm
d02dfc049413b725c4255887487cfa67
source rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/src/openssh-3.4p1-214.src.rpm
26dd44e9bed7a5ad2d35e56301dc5489
SuSE-8.0:
ftp://ftp.suse.com/pub/suse/i386/update/8.0/sec1/openssh-3.4p1-214.i386.rpm
2361dccd5b0c83178f8d0d5988b3490e
patch rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/8.0/sec1/openssh-3.4p1-214.i386.patch.rpm
5bef6aff5a603e3376a2f907c494ea7e
source rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/openssh-3.4p1-214.src.rpm
203aab39cdb7c5672a82bb07bc4a1f38
SuSE-7.3:
ftp://ftp.suse.com/pub/suse/i386/update/7.3/sec1/openssh-2.9.9p2-155.i386.rpm
1418135ed33e59d1ce37ea135617b5bc
source rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/openssh-2.9.9p2-155.src.rpm
9d0b789127d30cca9f45c7b1f2268673
SuSE-7.2:
ftp://ftp.suse.com/pub/suse/i386/update/7.2/sec1/openssh-2.9.9p2-155.i386.rpm
e807ecd9c4d167e3ef3764c06af1a511
source rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/openssh-2.9.9p2-155.src.rpm
a99aa03ba94f45dd25054b1ab1a962d7
Sparc Platform:
SuSE-7.3:
ftp://ftp.suse.com/pub/suse/sparc/update/7.3/sec1/openssh-2.9.9p2-52.sparc.rpm
e4f9b7e8763464d60761faf94b7f80f9
source rpm(s):
ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/openssh-2.9.9p2-52.src.rpm
ca0cbe5b564b03c64458868db369c4de
PPC Power PC Platform:
SuSE-7.3:
ftp://ftp.suse.com/pub/suse/ppc/update/7.3/sec1/openssh-2.9.9p2-108.ppc.rpm
0166ec0aec482b687bc2891611ae8ae9
source rpm(s):
ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/openssh-2.9.9p2-108.src.rpm
aed7879361a85f263a1cb3a00de964a1
______________________________________________________________________________
2) Pending vulnerabilities in SuSE Distributions and Workarounds:
- A buffer overflow vulnerability has been found in the mysql package,
an Open Source relational database system. The error may allow a remote
attacker to execute arbitrary code with the privileges of the database
process.
We are in the process of building and testing the update packages and
will release them with a SuSE Security Announcement as soon as possible.
______________________________________________________________________________
3) standard appendix: authenticity verification, additional information
- Package authenticity verification:
SuSE update packages are available on many mirror ftp servers all over
the world. While this service is being considered valuable and important
to the free and open source software community, many users wish to be
sure about the origin of the package and its content before installing
the package. There are two verification methods that can be used
independently from each other to prove the authenticity of a downloaded
file or rpm package:
1) md5sums as provided in the (cryptographically signed) announcement.
2) using the internal gpg signatures of the rpm package.
1) execute the command
md5sum
On Tuesday 16 September 2003 9:47 pm, Roman Drahtmueller wrote:
Please note that we have disabled the Privilege Separation feature in the ssh daemon (sshd) with this update. The PrivSep feature is designed to have parts of the ssh daemon's work running under lowered privileges, thereby limiting the effect of a possible vulnerability in the code. The PrivSep feature is turned on/off by the UsePrivilegeSeparation keyword in sshd's configuration file /etc/ssh/sshd_config. The feature is held responsible for malfunctions in PAM (Pluggable Authentification Modules). The update mechanism will not overwrite configuration files that have been altered after the package installation.
Why has this been disabled? As part of the CERT advisory it recommends that it is on. http://www.cert.org/advisories/CA-2003-24.html Cheers, Jon -- SuSE Linux 8.2 (i586) Linux 2.4.20-4GB-athlon ruby 1.8.0 (2003-09-10) [i686-linux]
Sorry. My bad. CERT: Patch your system OR turn on privilege separation. Jon (who shouldn't read CERT advisories so early in the morning!) -- SuSE Linux 8.2 (i586) Linux 2.4.20-4GB-athlon ruby 1.8.0 (2003-09-10) [i686-linux]
For some reason, the OpenSSH update does not appear in yast as a update, but still is installed. This type of behaviour appears to happen pretty regularly in yast. /Sigfred
On Wed September 17 2003 1:37 pm, Sigfred Håversen wrote:
For some reason, the OpenSSH update does not appear in yast as a update, but still is installed. This type of behaviour appears to happen pretty regularly in yast.
/Sigfred
When you are in YOU installing patches make sure the "Include Installed Patches" box is checked and then you'll see those 'hidden' updates. Baffled me with the most recent kernel updates that weren't visible but magically downloaded and installed. Stan
On Wednesday 17 September 2003 6:02 pm, Stan Glasoe wrote:
On Wed September 17 2003 1:37 pm, Sigfred H�ersen wrote:
For some reason, the OpenSSH update does not appear in yast as a update, but still is installed. This type of behaviour appears to happen pretty regularly in yast.
/Sigfred
When you are in YOU installing patches make sure the "Include Installed Patches" box is checked and then you'll see those 'hidden' updates. Baffled me with the most recent kernel updates that weren't visible but magically downloaded and installed.
This doesn't appear in my YOU. What is your YOU package? I am running KDE 3.1.3. My YOU is yast2-online-update-2.7.10-46 Thanks. Bob Pearson -- I am unique and special, just like everyone else.
On Wed September 17 2003 5:42 pm, Bob Pearson wrote:
On Wednesday 17 September 2003 6:02 pm, Stan Glasoe wrote:
On Wed September 17 2003 1:37 pm, Sigfred H�ersen wrote:
For some reason, the OpenSSH update does not appear in yast as a update, but still is installed. This type of behaviour appears to happen pretty regularly in yast.
/Sigfred
When you are in YOU installing patches make sure the "Include Installed Patches" box is checked and then you'll see those 'hidden' updates. Baffled me with the most recent kernel updates that weren't visible but magically downloaded and installed.
This doesn't appear in my YOU. What is your YOU package? I am running KDE 3.1.3. My YOU is yast2-online-update-2.7.10-46
Thanks.
Bob Pearson -- I am unique and special, just like everyone else.
Same, same. Are you going to YaST2, Software, Online Update and then under the Filter: You Patches pane there is the little check box "Include Installed Patches". Toggling/checking this on/off expands/contracts the list. Default behavior is to list the patches you have NOT installed (empty box beside the patch listing) because you haven't installed the base package. Stan
On Wednesday 17 September 2003 10:43 pm, Stan Glasoe wrote:
Same, same. Are you going to YaST2, Software, Online Update and then under the Filter: You Patches pane there is the little check box "Include Installed Patches". Toggling/checking this on/off expands/contracts the list. Default behavior is to list the patches you have NOT installed (empty box beside the patch listing) because you haven't installed the base package.
D'oh! Thanks, I didn't see it behind my doughnuts. Ahggaah, doughnuts;-p Thanks. -- I am unique and special, just like everyone else.
participants (5)
-
Bob Pearson -
Jonathan Lim -
Roman Drahtmueller -
Sigfred Håversen -
Stan Glasoe