Re: [gentoo-dev] OpenSSH Security Fix.

[Chris Davies]

Hi,

Yep. Noticed that a few minutes after I sent the e-mail. I must have 
done my rsync before this package was added.
My Bad.
Thanks,
C.Davies
(c.davies@×××××××.org)

Ferry Meyndert wrote:

>Its allready fixed in gentoo here is a copy of the anouncement send to the anouncement list.
>- --------------------------------------------------------------------------
>GENTOO LINUX SECURITY ANNOUNCEMENT
>- --------------------------------------------------------------------------
>
>PACKAGE        :openssh
>SUMMARY        :vulnerable to a off-by-one error in the channel code
>DATE           :2002-04-7 18:02:00
>
>- --------------------------------------------------------------------------
>
>OVERVIEW
>
>
> A bug exists in the channel code of OpenSSH versions 2.0 - 3.0.2
> Users with an existing user account can abuse this bug to
> gain root privileges. Exploitability without an existing
> user account has not been proven but is not considered
> impossible. A malicious ssh server could also use this bug
> to exploit a connecting vulnerable client.
>
>
>DETAIL
>
> http://www.pine.nl/advisories/pine-cert-20020301.txt
>
>
>SOLUTION
>
>
> It is recommended that all openssh users apply the update
>
> Portage Auto:
>
> emerge rsync
> emerge update
> emerge update --world
>
>
> Portage by hand:
>
> emerge rsync
> emerge net-misc/openssh
>
> Manually:
>
> Download the new openssh package here and follow in file instructions:
> ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-3.1p1.tar.gz
>
>- --------------------------------------------------------------------------
>Ferry Meyndert
>m0rpheus@g.o
>- --------------------------------------------------------------------------
>
>
>On Thu, 07 Mar 2002 20:04:55 +0000
>Chris Davies <c.davies@×××××××.org> wrote:
>
>>Hi,
>>
>>I haven't seen anything in bugs or this list about this, so here is the
>>news:
>>CERT have issued an advisory about OpenSSH, the bug in question enables
>>existing users to gain root privelidges.
>>The advisory is here: http://www.pine.nl/advisories/pine-cert-20020301.txt
>>The fix is to upgrade to the latest OpenSSH (3.1p1) ASAP.
>>May I politely suggest that a new ebuild be constructed post-haste? :)
>>Anyway, for those at risk, I have constructed an emergency ebuild and
>>digest file, so you may upgrade immediately.
>>The files can be found here: http://www.cdavies.org/gentoo/
>>
>>Put the digest file in /usr/portage/net-misc/openssh/files and the
>>ebuild in /usr/portage/net-misc/openssh and rerun emerge openssh.
>>
>>If anyone thinks it is worthwhile, I will also post this message to the
>>gentoo users list, but at present I'm not going to do that.
>>Thanks,
>>C.Davies
>>(c.davies@×××××××.org)
>>
>>
>>_______________________________________________
>>gentoo-dev mailing list
>>gentoo-dev@g.o
>>http://lists.gentoo.org/mailman/listinfo/gentoo-dev
>>
>_______________________________________________
>gentoo-dev mailing list
>gentoo-dev@g.o
>http://lists.gentoo.org/mailman/listinfo/gentoo-dev
>