Mailinglist Archive: opensuse-updates (137 mails)

< Previous Next >
openSUSE-SU-2016:0882-1: moderate: Security update for dropbear
openSUSE Security Update: Security update for dropbear
______________________________________________________________________________

Announcement ID: openSUSE-SU-2016:0882-1
Rating: moderate
References: #970633
Cross-References: CVE-2016-3116
Affected Products:
openSUSE Leap 42.1
openSUSE 13.2
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:


dropbear was updated to 2016.72 to fix the following issues:

Changes in dropbear:
- updated to upstream version 2016.72
* Validate X11 forwarding input. Could allow bypass of authorized_keys
command= restrictions, found by github.com/tintinweb. Thanks for
Damien Miller for a patch.
- used as bug fix release for boo#970633 - CVE-2016-3116

- updated to upstream version 2015.71
* Fix "bad buf_incrpos" when data is transferred, broke in 2015.69
* Fix crash on exit when -p address:port is used, broke in 2015.68
* Fix building with only ENABLE_CLI_REMOTETCPFWD given, patch from
Konstantin Tokarev
* Fix bad configure script test which didn't work with dash shell, patch
from Juergen Daubert, broke in 2015.70
* Fix server race condition that could cause sessions to hang on exit,
https://github.com/robotframework/SSHLibrary/issues/128

- updated to upstream version 2015.70
* Fix server password authentication on Linux, broke in 2015.69
* Fix crash when forwarded TCP connections fail to connect (bug
introduced in 2015.68)
* Avoid hang on session close when multiple sessions are started,
affects Qt Creator Patch from Andrzej Szombierski
* Reduce per-channel memory consumption in common case, increase default
channel limit from 100 to 1000 which should improve SOCKS forwarding
for modern webpages
* Handle multiple command line arguments in a single flag, thanks to
Guilhem Moulin
* Manpage improvements from Guilhem Moulin
* Build fixes for Android from Mike Frysinger
* Don't display the MOTD when an explicit command is run from Guilhem
Moulin
* Check curve25519 shared secret isn't zero

- updated to upstream version 2015.68
* Reduce local data copying for improved efficiency. Measured 30%
increase in throughput for connections to localhost
* Forwarded TCP ports connect asynchronously and try all available
addresses (IPv4, IPv6, round robin DNS)
* Fix all compile warnings, many patches from Gaël Portay Note that
configure with -Werror may not be successful on some platforms (OS X)
and some configuration options may still result in unused variable
warnings.
* Use TCP Fast Open on Linux if available. Saves a round trip at
connection to hosts that have previously been connected. Needs a
recent Linux kernel and possibly "sysctl -w net.ipv4.tcp_fastopen=3"
Client side is disabled by default pending further compatibility
testing with networks and systems.
* Increase maximum command length to 9000 bytes
* Free memory before exiting, patch from Thorsten Horstmann. Useful for
Dropbear ports to embedded systems and for checking memory leaks with
valgrind. Only partially implemented for dbclient. This is disabled by
default, enable with DROPBEAR_CLEANUP in sysoptions.h
* DROPBEAR_DEFAULT_CLI_AUTHKEY setting now always prepends home
directory unless there is a leading slash (~ isn't treated specially)
* Fix small ECC memory leaks
* Tighten validation of Diffie-Hellman parameters, from Florent
Daigniere of Matta Consulting. Odds of bad values are around 2**-512
-- improbable.
* Twofish-ctr cipher is supported though disabled by default
* Fix pre-authentication timeout when waiting for client SSH-2.0 banner,
thanks to CL Ouyang
* Fix null pointer crash with restrictions in authorized_keys without a
command, patch from Guilhem Moulin
* Ensure authentication timeout is handled while reading the initial
banner, thanks to CL Ouyang for finding it.
* Fix null pointer crash when handling bad ECC keys. Found by afl-fuzz

- fixed checksum URL

- updated to upstream version 2015.67
* Call fsync() after generating private keys to ensure they aren't lost
if a reboot occurs. Thanks to Peter Korsgaard
* Disable non-delayed zlib compression by default on the server. Can be
enabled if required for old clients with DROPBEAR_SERVER_DELAY_ZLIB
* Default client key path ~/.ssh/id_dropbear
* Prefer stronger algorithms by default, from Fedor Brunner. AES256 over
3DES Diffie-hellman group14 over group1
* Add option to disable CBC ciphers.
* Disable twofish in default options.h
* Enable sha2 HMAC algorithms by default, the code was already required
for ECC key exchange. sha1 is the first preference still for
performance.
* Fix installing dropbear.8 in a separate build directory, from Like Ma
* Allow configure to succeed if libtomcrypt/libtommath are missing, from
Elan Ruusamäe
* Don't crash if ssh-agent provides an unknown type of key. From Catalin
Patulea
* Minor bug fixes, a few issues found by Coverity scan

- replaced deprecated gpg-offline check by obs-service-source_validator

- updated to upstream version 2014.66
* Use the same keepalive handling behaviour as OpenSSH. This will work
better with some SSH implementations that have different behaviour
with unknown message types.
* Don't reply with SSH_MSG_UNIMPLEMENTED when we receive a reply to our
own keepalive message
* Set $SSH_CLIENT to keep bash happy, patch from Ryan Cleere
* Fix wtmp which broke since 2013.62, patch from Whoopie


Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

- openSUSE Leap 42.1:

zypper in -t patch openSUSE-2016-387=1

- openSUSE 13.2:

zypper in -t patch openSUSE-2016-387=1

To bring your system up-to-date, use "zypper patch".


Package List:

- openSUSE Leap 42.1 (i586 x86_64):

dropbear-2016.72-8.1
dropbear-debuginfo-2016.72-8.1
dropbear-debugsource-2016.72-8.1

- openSUSE 13.2 (i586 x86_64):

dropbear-2016.72-2.3.1
dropbear-debuginfo-2016.72-2.3.1
dropbear-debugsource-2016.72-2.3.1


References:

https://www.suse.com/security/cve/CVE-2016-3116.html
https://bugzilla.suse.com/970633


< Previous Next >
This Thread
  • No further messages