Comme cela a l'air assez important (SSH fait souvent partie de l'infrastructure de *s�curisation*), je passe cet advisory.
Si jamais, pour ceux qui ont Debian stable + KDE (avec les `optional' install�s), un package mis � jour est disponible �: http://search.alphanet.ch/~schaefer/potato/kde-update/OPENSSH/ sign� avec la cl� GPG de debian.ch La source utilis�e y est aussi, pour double contr�le. From: Joost Pol <[EMAIL PROTECTED]> Newsgroups: alphanet.ml.security.bug-traq Subject: [PINE-CERT-20020301] OpenSSH off-by-one Date: 7 Mar 2002 18:07:28 +0100 Message-ID: <[EMAIL PROTECTED]> - ----------------------------------------------------------------------------- Pine Internet Security Advisory - ----------------------------------------------------------------------------- Advisory ID : PINE-CERT-20020301 Authors : Joost Pol <[EMAIL PROTECTED]> Issue date : 2002-03-07 Application : OpenSSH Version(s) : All versions between 2.0 and 3.0.2 Platforms : multiple Vendor informed : 20020304 Availability : http://www.pine.nl/advisories/pine-cert-20020301.txt - ----------------------------------------------------------------------------- Synopsis A bug exists in the channel code of OpenSSH versions 2.0 - 3.0.2 Users with an existing user account can abuse this bug to gain root privileges. Exploitability without an existing user account has not been proven but is not considered impossible. A malicious ssh server could also use this bug to exploit a connecting vulnerable client. Impact HIGH: Existing users will gain root privileges. Description Simple off by one error. Patch included. Solution The OpenSSH project will shortly release version 3.1. Upgrading to this version is highly recommended. This version will be made available at http://www.openssh.com The FreeBSD port of OpenSSH has been updated to reflect the patches as supplied in this document. OpenSSH CVS has been updated, see http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/ \ channels.c.diff?r1=1.170&r2=1.171 Or apply the attached patch as provided by PINE Internet: http://www.pine.nl/advisories/pine-cert-20020301.patch - Pour poster une annonce: [EMAIL PROTECTED]
