TUCoPS :: Linux :: Apps N-Z :: bt826.txt

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
________________________________________________________________________
OpenPKG Security Advisory The OpenPKG Project
http://www.openpkg.org/security.html http://www.openpkg.org
openpkg-security@openpkg.org openpkg@openpkg.org
OpenPKG-SA-2003.035 06-Aug-2003
________________________________________________________________________
Package: openssh
Vulnerability: information leakage
OpenPKG Specific: no
Affected Releases: Affected Packages: Corrected Packages:
OpenPKG CURRENT <= openssh-3.6.1p1-20030423 >= openssh-3.6.1p2-20030429
OpenPKG 1.3 none N.A.
OpenPKG 1.2 <= openssh-3.5p1-1.2.1 >= openssh-3.5p1-1.2.2
Dependent Packages: none
Description:
 According to a Mediaservice.net security advisory [0], an information
 leakage exists in OpenSSH [1] 3.6.1p1 and earlier if PAM support
 is enabled. When a user does not exists, an error message is sent
 immediately (without any delays) which allows remote attackers to
 determine valid usernames via a timing attack. OpenPKG installations
 are only affected if the package was build with option "with_pam"
 set to "yes" -- which is not the default. The Common Vulnerabilities
 and Exposures (CVE) project assigned the id CAN-2003-0190 [2] to the
 problem.
 
 We could only reproduce the problem on Linux. FreeBSD and Solaris are
 not vulnerable, the patch does not affect their behaviour. However,
 the problem is related to the PAM configuration, not the operating
 system. Using a non-default configuration might leak information on
 other operating systems, too. On Linux systems, a valid workaround is
 to add a "nodelay" option to the pam_unix.so auth.
 Please check whether you are affected by running "<prefix>/bin/rpm -q
 openssh". If you have the "openssh" package installed and its version
 is affected (see above), we recommend that you immediately upgrade it
 (see Solution).
Solution:
 Select the updated source RPM appropriate for your OpenPKG release
 [5], fetch it from the OpenPKG FTP service [6] or a mirror location,
 verify its integrity [7], build a corresponding binary RPM from it [3]
 and update your OpenPKG installation by applying the binary RPM [4].
 For the current release OpenPKG 1.2, perform the following operations
 to permanently fix the security problem (for other releases adjust
 accordingly).
 $ ftp ftp.openpkg.org
 ftp> bin
 ftp> cd release/1.2/UPD
 ftp> get openssh-3.5p1-1.2.2.src.rpm
 ftp> bye
 $ <prefix>/bin/rpm -v --checksig openssh-3.5p1-1.2.2.src.rpm
 $ <prefix>/bin/rpm --rebuild openssh-3.5p1-1.2.2.src.rpm
 $ su -
 # <prefix>/bin/rpm -Fvh <prefix>/RPM/PKG/openssh-3.5p1-1.2.2.*.rpm
________________________________________________________________________
References:
 [0] http://lab.mediaservice.net/advisory/2003-01-openssh.txt
 [1] http://www.openssh.com/
 [2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0190
 [3] http://www.openpkg.org/tutorial.html#regular-source
 [4] http://www.openpkg.org/tutorial.html#regular-binary
 [5] ftp://ftp.openpkg.org/release/1.2/UPD/openssh-3.5p1-1.2.2.src.rpm
 [6] ftp://ftp.openpkg.org/release/1.2/UPD/
 [7] http://www.openpkg.org/security.html#signature
________________________________________________________________________
For security reasons, this advisory was digitally signed with the
OpenPGP public key "OpenPKG <openpkg@openpkg.org>" (ID 63C4CB9F) of the
OpenPKG project which you can retrieve from http://pgp.openpkg.org and
hkp://pgp.openpkg.org. Follow the instructions on http://pgp.openpkg.org/
for details on how to verify the integrity of this advisory.
________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Comment: OpenPKG <openpkg@openpkg.org>
iD8DBQE/MQR9gHWT4GPEy58RAiKkAKCpACytbxQN0ERLBbqNfmbZYYc59wCg6V33
XFH1dFEVD0jBbdBvvdIdIZM=
=GtfK
-----END PGP SIGNATURE-----