Advisory:

RHSA-2003:279-07

Last updated on:

2003-09-16

Affected Products:

Red Hat Linux 7.1

Red Hat Linux 7.2

Red Hat Linux 7.3

Red Hat Linux 8.0

Red Hat Linux 9

CVEs (cve.mitre.org):

CAN-2003-0693





back

Security Advisory





Details:





Updated OpenSSH packages are now available that fix a bug that may be

remotely exploitable.





OpenSSH is a suite of network connectivity tools that can be used to

establish encrypted connections between systems on a network and can

provide interactive login sessions and port forwarding, among other functions.



The OpenSSH team has announced a bug which affects the OpenSSH buffer

handling code. This bug has the potential of being remotely exploitable.



All users of OpenSSH should immediately apply this update which contains a

backported fix for this issue.





Updated packages:

Red Hat Linux 7.1

SRPMS:

openssh-3.1p1-9.src.rpm

[ via FTP ] [ via HTTP ]

68c4a788b259ac5d80696344a1635238



i386:

openssh-3.1p1-9.i386.rpm

[ via FTP ] [ via HTTP ]

2cb116a25b5d3f2ae0290c2b02eb822a

openssh-askpass-3.1p1-9.i386.rpm

[ via FTP ] [ via HTTP ]

8871705678463c84f5bac0d7e314c51d

openssh-askpass-gnome-3.1p1-9.i386.rpm

[ via FTP ] [ via HTTP ]

d40669604c1003d5fa56a0fe8f5f259f

openssh-clients-3.1p1-9.i386.rpm

[ via FTP ] [ via HTTP ]

ad58192a0988ae2ba28303892344dc15

openssh-server-3.1p1-9.i386.rpm

[ via FTP ] [ via HTTP ]

275ab4661dfef3d2331a044723728ba8



Red Hat Linux 7.2

SRPMS:

openssh-3.1p1-10.src.rpm

[ via FTP ] [ via HTTP ]

8a643b9a1c2081510494bcfe81d704da



i386:

openssh-3.1p1-10.i386.rpm

[ via FTP ] [ via HTTP ]

41d575bf0e8740dea7be6f228cd49a06

openssh-askpass-3.1p1-10.i386.rpm

[ via FTP ] [ via HTTP ]

4b768a29889a977e780f40829767f139

openssh-askpass-gnome-3.1p1-10.i386.rpm

[ via FTP ] [ via HTTP ]

c6ade41287005e1bc3e773d489571b2f

openssh-clients-3.1p1-10.i386.rpm

[ via FTP ] [ via HTTP ]

ac2a157d5527b94629b393709dafee88

openssh-server-3.1p1-10.i386.rpm

[ via FTP ] [ via HTTP ]

dfd86218d209c998c1f5877470e08ee3



ia64:

openssh-3.1p1-10.ia64.rpm

[ via FTP ] [ via HTTP ]

35ed02df36d62ae2ae388bdb1a2fde8b

openssh-askpass-3.1p1-10.ia64.rpm

[ via FTP ] [ via HTTP ]

00efc09f44de8e8757ed002b1c8f33d1

openssh-askpass-gnome-3.1p1-10.ia64.rpm

[ via FTP ] [ via HTTP ]

0a08a3bf5bdd95fb718c9f588aeb19a5

openssh-clients-3.1p1-10.ia64.rpm

[ via FTP ] [ via HTTP ]

ad1d2c29d579622abeb9aaddc3ba2205

openssh-server-3.1p1-10.ia64.rpm

[ via FTP ] [ via HTTP ]

baa9c271eea7d6d3d49fc14d4cc6cd20



Red Hat Linux 7.3

SRPMS:

openssh-3.1p1-10.src.rpm

[ via FTP ] [ via HTTP ]

8a643b9a1c2081510494bcfe81d704da



i386:

openssh-3.1p1-10.i386.rpm

[ via FTP ] [ via HTTP ]

41d575bf0e8740dea7be6f228cd49a06

openssh-askpass-3.1p1-10.i386.rpm

[ via FTP ] [ via HTTP ]

4b768a29889a977e780f40829767f139

openssh-askpass-gnome-3.1p1-10.i386.rpm

[ via FTP ] [ via HTTP ]

c6ade41287005e1bc3e773d489571b2f

openssh-clients-3.1p1-10.i386.rpm

[ via FTP ] [ via HTTP ]

ac2a157d5527b94629b393709dafee88

openssh-server-3.1p1-10.i386.rpm

[ via FTP ] [ via HTTP ]

dfd86218d209c998c1f5877470e08ee3



Red Hat Linux 8.0

SRPMS:

openssh-3.4p1-5.src.rpm

[ via FTP ] [ via HTTP ]

9b0e321ba85cb0d0d92aa8d2215b660b



i386:

openssh-3.4p1-5.i386.rpm

[ via FTP ] [ via HTTP ]

98eec1cabf75d33b4dab5cbcc1fa3916

openssh-askpass-3.4p1-5.i386.rpm

[ via FTP ] [ via HTTP ]

40a5f106abe732b2de667d8eea533bfb

openssh-askpass-gnome-3.4p1-5.i386.rpm

[ via FTP ] [ via HTTP ]

2d7066401fdffdc33d8432c5a6e15bf2

openssh-clients-3.4p1-5.i386.rpm

[ via FTP ] [ via HTTP ]

437bf2bd207673ce3ab9632e6c862972

openssh-server-3.4p1-5.i386.rpm

[ via FTP ] [ via HTTP ]

b1d6e055c373770fac486b1c32b1110b



Red Hat Linux 9

SRPMS:

openssh-3.5p1-9.src.rpm

[ via FTP ] [ via HTTP ]

7b1cf7bfc16af8675fef75f1c82825ca



i386:

openssh-3.5p1-9.i386.rpm

[ via FTP ] [ via HTTP ]

42127cbc814679cefd1db11265eb2ded

openssh-askpass-3.5p1-9.i386.rpm

[ via FTP ] [ via HTTP ]

301a68bc432e7ac55f847edbb30b4741

openssh-askpass-gnome-3.5p1-9.i386.rpm

[ via FTP ] [ via HTTP ]

baeb84c227233c05d5b6e9e3bc1bdd3d

openssh-clients-3.5p1-9.i386.rpm

[ via FTP ] [ via HTTP ]

78188bca46a3ccbba67d1040f42e3c07

openssh-server-3.5p1-9.i386.rpm

[ via FTP ] [ via HTTP ]

2233bfd17074fd127dac4f47b57e905c







Solution





Before applying this update, make sure all previously released errata

relevant to your system have been applied.



To update all RPMs for your particular architecture, run:



rpm -Fvh [filenames]



where [filenames] is a list of the RPMs you wish to upgrade. Only those

RPMs which are currently installed will be updated. Those RPMs which are

not installed but included in the list will not be updated. Note that you

can also use wildcards (*.rpm) if your current directory *only* contains the

desired RPMs.



Please note that this update is also available via Red Hat Network. Many

people find this an easier way to apply updates. To use Red Hat Network,

launch the Red Hat Update Agent with the following command:



up2date



This will start an interactive process that will result in the appropriate

RPMs being upgraded on your system.



If up2date fails to connect to Red Hat Network due to SSL Certificate

Errors, you need to install a version of the up2date client with an updated

certificate. The latest version of up2date is available from the Red Hat

FTP site and may also be downloaded directly from the RHN website:



https://rhn.redhat.com/help/latest-up2date.pxt





References:







http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0693

http://marc.theaimsgroup.com/?l=openbsd-misc&m=106371592604940

The listed packages are GPG signed by Red Hat, Inc. for security. Our

key is available at:

http://www.redhat.com/solutions/security/news/publickey/#key





You can verify each package and see who signed it with the following

command:

rpm --checksig -v filename





If you only wish to verify that each package has not been corrupted or

tampered with, examine only the md5sum with the following command:

md5sum filename





The Red Hat security contact is security@redhat.com. More

contact details at http://www.redhat.com/solutions/security/news/contact.html