-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mitel Networks Security Advisory: openssh Synopsis: Updated OpenSSH packages fix potential vulnerability Release Date: 2003-09-17 Severity: Critical Affected Products: SME Server (all versions) CVE (http://cve.mitre.org/): CAN-2003-0693 ---------------------------------------------------------- PROBLEM DESCRIPTION ---------------------------------------------------------- The versions of the OpenSSH package provided for optional remote access in products based on the unsupported developer version of the SME Server (and its commercial counterpart, the 6000 MAS) are potentially vulnerable to a buffer management error. It is unclear at this time if this vulnerability can be remotely exploited, but due to the critical role ssh plays in secure communication we are issuing this advisory. It is important to note that the SME Server ship with ssh access DISABLED BY DEFAULT. The server administrator would specifically need to enable ssh access through the "Remote access" panel in the web-based server manager. We are aware, however, that many users do enable ssh for remote administration. Mitel Networks encourages all administrators to apply this update immediately and to disable remote access via ssh until the update has been applied. Note that versions of the unsupported developer release earlier than 5.6 are also vulnerable, but Mitel Networks no longer provides patches for those versions. Users of those obsolete versions should: - disable ssh access until an upgrade can be performed - upgrade to either 5.6 or 6.0beta3 and apply the update for that version ---------------------------------------------------------- Solution ---------------------------------------------------------- Administrators of the commercial version of the product (the 6000 MAS) can simply apply the update by going to the "Blades" panel of the server manager and installing/upgrading the "ServiceLink" blade. Commercial users can ask their reseller about Mitel Networks Security Advisory MNSA-2003-003 which contains more information.
Users of the unsupported developer version need to download the following RPMs from one of our mirror sites (see http://www.e-smith.org/download/ ). MD5 sums are supplied below for verification. Note that this update is different from the OpenSSH packages released for Red Hat Linux 7.x as we have chosen to use the latest available version of OpenSSH and enable additional security features. 6.0beta3: ========= 5fa5821927b79f045f52f988ec40a5dd e-smith-openssh-1.10.1-01.noarch.rpm c6ef75446647bdd445fe6d8c4670f649 openssh-3.7.1p1-1es2.i386.rpm 1ff815888b5b16c353c74ab75bd2cd9a openssh-clients-3.7.1p1-1es2.i386.rpm 2e332e6080106b91a05b781c1a6c0b02 openssh-server-3.7.1p1-1es2.i386.rpm 5.6: ==== f43fbe7957933d097328cee1b4d07a0f e-smith-openssh-1.8.1-02.noarch.rpm c6ef75446647bdd445fe6d8c4670f649 openssh-3.7.1p1-1es2.i386.rpm 1ff815888b5b16c353c74ab75bd2cd9a openssh-clients-3.7.1p1-1es2.i386.rpm 2e332e6080106b91a05b781c1a6c0b02 openssh-server-3.7.1p1-1es2.i386.rpm ---------------------------------------------------------- References ---------------------------------------------------------- For more information about this potential vulnerability, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0693 http://www.cert.org/advisories/CA-2003-24.html http://www.openssh.com/txt/buffer.adv ---------------------------------------------------------- CONTACT INFORMATION ---------------------------------------------------------- To contact Mitel Networks about this alert, please e-mail: [EMAIL PROTECTED] Mitel Networks Product Security Team Copyright 2003 Mitel Networks Corporation ---------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (MingW32) - WinPT 0.7.96rc1 iD8DBQE/a1BTtVk55/fjw7QRAtHgAKDNXupHtXFWeeWl9ELKIdcgEUP31gCeIijS ob/T9l6GGkPlte40LCL/i5I= =rKtx -----END PGP SIGNATURE----- -- Please report bugs to [EMAIL PROTECTED] Please mail [EMAIL PROTECTED] (only) to discuss security issues Support for registered customers and partners to [EMAIL PROTECTED] To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] Searchable archive at http://www.mail-archive.com/devinfo%40lists.e-smith.org
