Date: Thu, 7 Mar 2002 11:38:52 -0500 (EST)
From: EnGarde Secure Linux <[email protected]>
To: [email protected], [email protected]Subject: [ESA-20020307-007] Local vulnerability in OpenSSH's channel code.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
+------------------------------------------------------------------------+
| EnGarde Secure Linux Security Advisory March 07, 2002 |
| http://www.engardelinux.org/ ESA-20020307-007 |
| |
| Packages: openssh, openssh-clients, openssh-server |
| Summary: Local vulnerability in OpenSSH's channel code. |
+------------------------------------------------------------------------+
EnGarde Secure Linux is a secure distribution of Linux that features
improved access control, host and network intrusion detection, Web
based secure remote management, complete e-commerce using AllCommerce,
and integrated open source security tools.
OVERVIEW
- --------
There is a local vulnerability in the OpenSSH channel code which may
allow a local, authenticated user to exploit the server.
DETAIL
- ------
Joost Pol <[email protected]> outlined this bug in Pine Internet Security
Advisory PINE-CERT-20020301:
http://www.pine.nl/advisories/pine-cert-20020301
"Users with an existing user account can abuse this bug to
gain root privileges. Exploitability without an existing
user account has not been proven but is not considered
impossible. A malicious ssh server could also use this bug
to exploit a connecting vulnerable client."
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2002-0083 to this issue.
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0083
SOLUTION
- --------
All users should upgrade to the most recent version as outlined in
this advisory.
Guardian Digital recently made available the Guardian Digital Secure
Network, a means to proactively keep systems secure and manage
system software. EnGarde users can automatically update their system
using the Guardian Digital WebTool secure interface.
If choosing to manually upgrade this package, updates can be
obtained from:
ftp://ftp.engardelinux.org/pub/engarde/stable/updates/http://ftp.engardelinux.org/pub/engarde/stable/updates/
Before upgrading the package, the machine must either:
a) be booted into a "standard" kernel; or
b) have LIDS disabled.
To disable LIDS, execute the command:
# /sbin/lidsadm -S -- -LIDS_GLOBAL
To install the updated package, execute the command:
# rpm -Uvh <filename>
You must now update the LIDS configuration by executing the command:
# /usr/sbin/config_lids.pl
To re-enable LIDS (if it was disabled), execute the command:
# /sbin/lidsadm -S -- +LIDS_GLOBAL
To verify the signatures of the updated packages, execute the command:
# rpm -Kv <filename>
UPDATED PACKAGES
- ----------------
These updated packages are only for EnGarde Secure Linux Community
Edition.
Source Packages:
SRPMS/openssh-2.3.0p1-1.0.18.src.rpm
MD5 Sum: 675ca26dd4cf1bddb3363b65433a8833
i386 Binary Packages:
i386/openssh-2.3.0p1-1.0.18.i386.rpm
MD5 Sum: 8564be9e0d904b29bbea0ce743e14f51
i386/openssh-clients-2.3.0p1-1.0.18.i386.rpm
MD5 Sum: a42d161a88ad830abec45a13b2ee710c
i386/openssh-server-2.3.0p1-1.0.18.i386.rpm
MD5 Sum: 77cf681f7b0e530d98ab784edec3a76f
i686 Binary Packages:
i686/openssh-2.3.0p1-1.0.18.i686.rpm
MD5 Sum: a703f0046b35d7d08ee3a6354dde25ea
i686/openssh-clients-2.3.0p1-1.0.18.i686.rpm
MD5 Sum: e0e8de4271d26f36c75b28c727906bb4
i686/openssh-server-2.3.0p1-1.0.18.i686.rpm
MD5 Sum: 96d91d85f116934737bd3e1419bd90c0
REFERENCES
- ----------
Guardian Digital's public key:
http://ftp.engardelinux.org/pub/engarde/ENGARDE-GPG-KEY
Credit for the discovery of this bug goes to:
Joost Pol <[email protected]>
OpenSSH's Official Web Site:
http://www.openssh.org/
Security Contact: [email protected]
EnGarde Advisories: http://www.engardelinux.org/advisories.html
- --------------------------------------------------------------------------
$Id: ESA-20020307-007-openssh,v 1.2 2002/03/07 16:27:48 rwm Exp $
- --------------------------------------------------------------------------
Author: Ryan W. Maple, <[email protected]>
Copyright 2002, Guardian Digital, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE8h5ekHD5cqd57fu0RAikiAJ4hBhPpIJlCi550HssJDCaNYtpfqACbB9lj
5Ddl3sDxMGN0dbatzTzSzUk=
=Bh8V
-----END PGP SIGNATURE-----
