Hello community, here is the log from the commit of package dropbear.5406 for openSUSE:13.2:Update checked in at 2016-07-27 15:30:00 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:13.2:Update/dropbear.5406 (Old) and /work/SRC/openSUSE:13.2:Update/.dropbear.5406.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "dropbear.5406" Changes: -------- New Changes file: --- /dev/null 2016-07-07 10:01:34.856033756 +0200 +++ /work/SRC/openSUSE:13.2:Update/.dropbear.5406.new/dropbear.changes 2016-07-27 15:30:01.000000000 +0200 @@ -0,0 +1,364 @@ +------------------------------------------------------------------- +Thu Jul 21 16:13:41 UTC 2016 - thardeck@suse.com + +- update to upstream version 2016.74 + * Security: Message printout was vulnerable to format string injection. + If specific usernames including "%" symbols can be created on a system + (validated by getpwnam()) then an attacker could run arbitrary code as root + when connecting to Dropbear server. + A dbclient user who can control username or host arguments could potentially + run arbitrary code as the dbclient user. This could be a problem if scripts + or webpages pass untrusted input to the dbclient program. + * Security: dropbearconvert import of OpenSSH keys could run arbitrary code as + the local dropbearconvert user when parsing malicious key files + * Security: dbclient could run arbitrary code as the local dbclient user if + particular -m or -c arguments are provided. This could be an issue where + dbclient is used in scripts. + * Security: dbclient or dropbear server could expose process memory to the + running user if compiled with DEBUG_TRACE and running with -v + The security issues were reported by an anonymous researcher working with + Beyond Security's SecuriTeam Secure Disclosure www.beyondsecurity.com/ssd.html + * Fix port forwarding failure when connecting to domains that have both + IPv4 and IPv6 addresses. The bug was introduced in 2015.68 + * Fix 100% CPU use while waiting for rekey to complete. Thanks to Zhang Hui P + for the patch + +------------------------------------------------------------------- +Mon Mar 21 08:38:43 UTC 2016 - thardeck@suse.com + +- updated to upstream version 2016.73 + * Support syslog in dbclient, option -o usesyslog=yes. Patch from Konstantin Tokarev + * Kill a proxycommand when dbclient exits, patch from Konstantin Tokarev + * Option to exit when a TCP forward fails, patch from Konstantin Tokarev + * New "-o" option parsing from Konstantin Tokarev. This allows handling some extra options + in the style of OpenSSH, though implementing all OpenSSH options is not planned. + * Fix crash when fallback initshells() is used, reported by Michael Nowak and Mike Tzou + * Allow specifying commands eg "dropbearmulti dbclient ..." instead of symlinks + * Various cleanups for issues found by a lint tool, patch from Francois Perrad + * Fix tab indent consistency, patch from Francois Perrad + * Fix issues found by cppcheck, reported by Mike Tzou + * Use system memset_s() or explicit_bzero() if available to clear memory. Also make + libtomcrypt/libtommath routines use that (or Dropbear's own m_burn()). + * Prevent scp failing when the local user doesn't exist. Based on patch from Michael Witten. + * Improved Travis CI test running, thanks to Mike Tzou + * Improve some code that was flagged by Coverity and Fortify Static Code Analyzer + +------------------------------------------------------------------- +Fri Mar 11 16:00:23 UTC 2016 - thardeck@suse.com + +- updated to upstream version 2016.72 + * Validate X11 forwarding input. Could allow bypass of authorized_keys command= restrictions, + found by github.com/tintinweb. Thanks for Damien Miller for a patch. +- used as bug fix release for bnc#970633 - VUL-0: CVE-2016-3116 + +------------------------------------------------------------------- +Fri Dec 4 15:39:10 UTC 2015 - thardeck@suse.com + +- updated to upstream version 2015.71 + * Fix "bad buf_incrpos" when data is transferred, broke in 2015.69 + * Fix crash on exit when -p address:port is used, broke in 2015.68 + * Fix building with only ENABLE_CLI_REMOTETCPFWD given, patch from Konstantin Tokarev + * Fix bad configure script test which didn't work with dash shell, patch from Juergen Daubert, + broke in 2015.70 + * Fix server race condition that could cause sessions to hang on exit, + https://github.com/robotframework/SSHLibrary/issues/128 + +------------------------------------------------------------------- +Thu Nov 26 15:40:52 UTC 2015 - thardeck@suse.com + +- updated to upstream version 2015.70 + * Fix server password authentication on Linux, broke in 2015.69 + * Fix crash when forwarded TCP connections fail to connect (bug introduced in 2015.68) + * Avoid hang on session close when multiple sessions are started, affects Qt Creator + Patch from Andrzej Szombierski + * Reduce per-channel memory consumption in common case, increase default + channel limit from 100 to 1000 which should improve SOCKS forwarding for modern + webpages + * Handle multiple command line arguments in a single flag, thanks to Guilhem Moulin + * Manpage improvements from Guilhem Moulin + * Build fixes for Android from Mike Frysinger + * Don't display the MOTD when an explicit command is run from Guilhem Moulin + * Check curve25519 shared secret isn't zero + +------------------------------------------------------------------- +Mon Aug 10 08:13:56 UTC 2015 - thardeck@suse.com + +- updated to upstream version 2015.68 + * Reduce local data copying for improved efficiency. Measured 30% + increase in throughput for connections to localhost + * Forwarded TCP ports connect asynchronously and try all available addresses + (IPv4, IPv6, round robin DNS) + * Fix all compile warnings, many patches from Gaël Portay + Note that configure with -Werror may not be successful on some platforms (OS X) + and some configuration options may still result in unused variable + warnings. + * Use TCP Fast Open on Linux if available. Saves a round trip at connection + to hosts that have previously been connected. + Needs a recent Linux kernel and possibly "sysctl -w net.ipv4.tcp_fastopen=3" + Client side is disabled by default pending further compatibility testing + with networks and systems. + * Increase maximum command length to 9000 bytes + * Free memory before exiting, patch from Thorsten Horstmann. Useful for + Dropbear ports to embedded systems and for checking memory leaks + with valgrind. Only partially implemented for dbclient. + This is disabled by default, enable with DROPBEAR_CLEANUP in sysoptions.h + * DROPBEAR_DEFAULT_CLI_AUTHKEY setting now always prepends home directory unless + there is a leading slash (~ isn't treated specially) + * Fix small ECC memory leaks + * Tighten validation of Diffie-Hellman parameters, from Florent Daigniere of + Matta Consulting. Odds of bad values are around 2**-512 -- improbable. + * Twofish-ctr cipher is supported though disabled by default + * Fix pre-authentication timeout when waiting for client SSH-2.0 banner, thanks + to CL Ouyang + * Fix null pointer crash with restrictions in authorized_keys without a command, patch from + Guilhem Moulin + * Ensure authentication timeout is handled while reading the initial banner, + thanks to CL Ouyang for finding it. + * Fix null pointer crash when handling bad ECC keys. Found by afl-fuzz + +------------------------------------------------------------------- +Thu Feb 5 16:26:06 UTC 2015 - thardeck@suse.com + +- fixed checksum URL + +------------------------------------------------------------------- +Wed Jan 28 21:40:28 UTC 2015 - thardeck@suse.com + +- updated to upstream version 2015.67 + * Call fsync() after generating private keys to ensure they aren't lost if a + reboot occurs. Thanks to Peter Korsgaard + * Disable non-delayed zlib compression by default on the server. Can be + enabled if required for old clients with DROPBEAR_SERVER_DELAY_ZLIB + * Default client key path ~/.ssh/id_dropbear + * Prefer stronger algorithms by default, from Fedor Brunner. + AES256 over 3DES + Diffie-hellman group14 over group1 + * Add option to disable CBC ciphers. + * Disable twofish in default options.h + * Enable sha2 HMAC algorithms by default, the code was already required + for ECC key exchange. sha1 is the first preference still for performance. + * Fix installing dropbear.8 in a separate build directory, from Like Ma + * Allow configure to succeed if libtomcrypt/libtommath are missing, from Elan Ruusamäe + * Don't crash if ssh-agent provides an unknown type of key. From Catalin Patulea + * Minor bug fixes, a few issues found by Coverity scan + +------------------------------------------------------------------- +Thu Dec 4 12:13:24 UTC 2014 - thardeck@suse.com + +- replaced deprecated gpg-offline check by obs-service-source_validator + +------------------------------------------------------------------- +Fri Oct 24 08:30:31 UTC 2014 - thardeck@suse.com + +- updated to upstream version 2014.66 + * Use the same keepalive handling behaviour as OpenSSH. This will work better + with some SSH implementations that have different behaviour with unknown + message types. + * Don't reply with SSH_MSG_UNIMPLEMENTED when we receive a reply to our own + keepalive message + * Set $SSH_CLIENT to keep bash happy, patch from Ryan Cleere + * Fix wtmp which broke since 2013.62, patch from Whoopie + +------------------------------------------------------------------- +Mon Aug 11 08:38:04 UTC 2014 - thardeck@suse.com + +- updated to upstream version 2014.65 + * Fix 2014.64 regression, server session hang on exit with scp (and probably + others), thanks to NiLuJe for tracking it down + * Fix 2014.64 regression, clock_gettime() error handling which broke on older + Linux kernels, reported by NiLuJe + * Fix 2014.64 regression, writev() could occassionally fail with EAGAIN which + wasn't caught + * Avoid error message when trying to set QoS on proxycommand or multihop pipes + * Use /usr/bin/xauth, thanks to Mike Frysinger + * Don't exit the client if the local user entry can't be found, thanks to iquaba + +------------------------------------------------------------------- +Mon Jul 28 09:40:02 UTC 2014 - thardeck@suse.com + +- removed obsolete gpg soure code verifcation workaround +- added missing systemd entries for dropbear-keygen.service +- updated to upstream version 2014.64 + * Fix compiling with ECDSA and DSS disabled + * Don't exit abruptly if too many outgoing packets are queued for writev(). Patch + thanks to Ronny Meeus + * The -K keepalive option now behaves more like OpenSSH's "ServerAliveInterval". + If no response is received after 3 keepalives then the session is terminated. This + will close connections faster than waiting for a TCP timeout. + * Rework TCP priority setting. New settings are + if (connecting || ptys || x11) tos = LOWDELAY + else if (tcp_forwards) tos = 0 + else tos = BULK + Thanks to Catalin Patulea for the suggestion. + * Improve handling of many concurrent new TCP forwarded connections, should now + be able to handle as many as MAX_CHANNELS. Thanks to Eduardo Silva for reporting + and investigating it. + * Make sure that exit messages from the client are printed, regression in 2013.57 + * Use monotonic clock where available, timeouts won't be affected by system time ++++ 167 more lines (skipped) ++++ between /dev/null ++++ and /work/SRC/openSUSE:13.2:Update/.dropbear.5406.new/dropbear.changes New: ---- dropbear-2016.74.tar.bz2 dropbear-2016.74.tar.bz2.asc dropbear-keygen.service dropbear.changes dropbear.init dropbear.service dropbear.spec dropbear.sysconfig ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ dropbear.spec ++++++ # # spec file for package dropbear # # Copyright (c) 2016 SUSE LINUX GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed # upon. The license for this file, and modifications and additions to the # file, is the same license as for the pristine package itself (unless the # license for the pristine package is not an Open Source License, in which # case the license is the MIT License). An "Open Source License" is a # license that conforms to the Open Source Definition (Version 1.9) # published by the Open Source Initiative. # Please submit bugfixes or comments via http://bugs.opensuse.org/ # %if 0%{?suse_version} >= 1230 %define using_systemd 1 %endif Name: dropbear Version: 2016.74 Release: 0 Summary: A relatively small SSH 2 server and client License: MIT Group: Productivity/Networking/SSH Url: http://matt.ucc.asn.au/dropbear/dropbear.html Source0: https://matt.ucc.asn.au/dropbear/%{name}-%{version}.tar.bz2 Source1: https://matt.ucc.asn.au/dropbear/%{name}-%{version}.tar.bz2.asc Source3: dropbear.service Source4: dropbear-keygen.service Source5: dropbear.sysconfig Source6: dropbear.init BuildRoot: %{_tmppath}/%{name}-%{version}-build BuildRequires: zlib-devel %if 0%{?using_systemd} %{?systemd_requires} %else Requires(pre): %insserv_prereq %endif Requires(pre): %fillup_prereq %description Dropbear is a SSH 2 server and client designed to be small enough to be used in small memory environments, while still being functional and secure enough for general use. It implements most required features of the SSH 2 protocol, and other features such as X11 and authentication agent forwarding. %prep %setup -q %build %configure make %{?_smp_mflags} %install make install DESTDIR=%{buildroot} install -d %{buildroot}%{_sysconfdir}/%{name} install -D -m 0644 %{SOURCE5} "%{buildroot}%{_localstatedir}/adm/fillup-templates/sysconfig.%{name}" %if 0%{?using_systemd} install -d %{buildroot}%{_unitdir} install -m 0644 %{SOURCE3} %{buildroot}%{_unitdir}/%{name}.service install -m 0644 %{SOURCE4} %{buildroot}%{_unitdir}/%{name}-keygen.service ln -sf /usr/sbin/service %{buildroot}%{_sbindir}/rc%{name} ln -sf /usr/sbin/service %{buildroot}%{_sbindir}/rc%{name}-keygen %else install -D -m0755 %{SOURCE6} "%{buildroot}%{_initrddir}/%{name}" ln -sf ../../%{_initrddir}/%{name} "%{buildroot}%{_sbindir}/rc%{name}" %endif %pre %if 0%{?using_systemd} %service_add_pre %{name}.service %service_add_pre %{name}-keygen.service %endif %post %if 0%{?using_systemd} %fillup_only %service_add_post %{name}.service %service_add_post %{name}-keygen.service %else %{fillup_and_insserv %{name}} %endif %preun %if 0%{?using_systemd} %service_del_preun %{name}.service %service_del_preun %{name}-keygen.service %else %stop_on_removal %{name} %endif %postun %if 0%{?using_systemd} %service_del_postun %{name}.service %service_del_postun %{name}-keygen.service %else %restart_on_update %{name} %insserv_cleanup %endif %files %defattr(-,root,root) %{_bindir}/dbclient %{_bindir}/dropbearconvert %{_bindir}/dropbearkey %{_sbindir}/dropbear %{_sbindir}/rcdropbear %if 0%{?using_systemd} %{_unitdir}/%{name}.service %{_unitdir}/dropbear-keygen.service %{_sbindir}/rcdropbear-keygen %else %{_initrddir}/%{name} %endif %dir %{_sysconfdir}/%{name} %{_localstatedir}/adm/fillup-templates/sysconfig.%{name} %{_mandir}/man8/dropbear.8.gz %{_mandir}/man1/dbclient.1.gz %{_mandir}/man1/dropbearkey.1.gz %{_mandir}/man1/dropbearconvert.1.gz %changelog ++++++ dropbear-keygen.service ++++++ [Unit] Description=Dropbear SSH Key Generator Documentation=man:dropbearkey(8) Before=dropbear.service ConditionPathExists=!/etc/dropbear/dropbear_rsa_host_key ConditionPathExists=!/etc/dropbear/dropbear_dss_host_key ConditionPathExists=!/etc/dropbear/dropbear_ecdsa_host_key [Service] Type=oneshot ExecStart=/usr/bin/dropbearkey -t rsa -f /etc/dropbear/dropbear_rsa_host_key ExecStart=/usr/bin/dropbearkey -t dss -f /etc/dropbear/dropbear_dss_host_key ExecStart=/usr/bin/dropbearkey -t ecdsa -f /etc/dropbear/dropbear_ecdsa_host_key RemainAfterExit=yes ++++++ dropbear.init ++++++ #!/bin/sh # Copyright (c) 2012 SUSE LINUX Products GmbH, Nuernberg, Germany. # # Startup script for Dropbear # # /etc/init.d/dropbear # # and its symbolic link # /usr/sbin/rcdropbear # ### BEGIN INIT INFO # Provides: dropbear # Required-Start: $network $remote_fs # Required-Stop: $network $remote_fs # Default-Start: 3 5 # Default-Stop: 0 1 2 6 # Short-Description: Dropbear # Description: Dropbear is a relatively small SSH 2 server. ### END INIT INFO # Note on runlevels: # 0 - halt/poweroff 6 - reboot # 1 - single user 2 - multiuser without network exported # 3 - multiuser w/ network (text mode) 5 - multiuser w/ network and X11 (xdm) . /etc/rc.status DROPBEAR_BIN="/usr/sbin/dropbear" DROPBEAR_LOCKFILE="/var/run/dropbear.pid" DROPBEAR_SYSCONFIG="/etc/sysconfig/dropbear" DROPBEAR_DSSKEY="/etc/dropbear/dropbear_dss_host_key" DROPBEAR_RSAKEY="/etc/dropbear/dropbear_rsa_host_key" DROPBEAR_ECDSAKEY="/etc/dropbear/dropbear_ecdsa_host_key" test -x $DROPBEAR_BIN || { echo "$DROPBEAR_BIN not installed"; if [ "$1" = "stop" ]; then exit 0; else exit 5; fi; } # Check for existence of sysconfig file and read it if [ -r "$DROPBEAR_SYSCONFIG" ]; then . "$DROPBEAR_SYSCONFIG" fi # Reset status of this service rc_reset case "$1" in start) echo -n "Starting Dropbear " if [ ! -r "$DROPBEAR_DSSKEY" ] || [ ! -r "$DROPBEAR_RSAKEY" ] || [ ! -r "$DROPBEAR_ECDSAKEY" ]; then $0 keygen fi startproc -p "$DROPBEAR_LOCKFILE" "$DROPBEAR_BIN" $OPTIONS # Remember status and be verbose rc_status -v ;; stop) echo -n "Shutting down Dropbear " killproc -p "$DROPBEAR_LOCKFILE" -TERM "$DROPBEAR_BIN" rc_status -v ;; try-restart) ## Do a restart only if the service was active before. $0 status if test $? = 0; then $0 restart else rc_reset # Not running is not a failure. fi rc_status ;; restart|reload) $0 stop $0 start rc_status ;; status) echo -n "Checking for Dropbear " checkproc -p "$DROPBEAR_LOCKFILE" "$DROPBEAR_BIN" rc_status -v ;; keygen) echo "Creating keys for Dropbear " if [ ! -r "$DROPBEAR_DSSKEY" ]; then dropbearkey -t dss -f "$DROPBEAR_DSSKEY" fi if [ ! -r "$DROPBEAR_RSAKEY" ]; then dropbearkey -t rsa -f "$DROPBEAR_RSAKEY" fi if [ ! -r "$DROPBEAR_ECDSAKEY" ]; then dropbearkey -t ecdsa -f "$DROPBEAR_ECDSAKEY" fi rc_status ;; *) echo "Usage: $0 {start|stop|status|try-restart|restart|reload|keygen}" exit 1 ;; esac rc_exit ++++++ dropbear.service ++++++ [Unit] Description=Dropbear SSH Server Daemon Documentation=man:dropbear(8) Wants=dropbear-keygen.service After=network.target [Service] EnvironmentFile=-/etc/sysconfig/dropbear ExecStart=/usr/sbin/dropbear -E -F $OPTIONS [Install] WantedBy=multi-user.target ++++++ dropbear.sysconfig ++++++ ## Path: Network/Remote access/Dropbear SSH ## Description: Dropbear startup parameters ## Type: string ## Default: "" # # Specifies Dropbear startup parameters # For example '-p <port>' changes the TCP port that Dropbear listens on # Check the dropbear manpage for additional options # OPTIONS=""