-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Alle 21:04, venerd́ 13 settembre 2002, Riccardo ha scritto: > Saluti a tutta la lista! > Qualcuno mi saprebbe indicare un how-to in rete oppure fornirmi una > guida su come fare per aggiornare il mio demone ssh? Vi ringrazio,
Messaggio firmato da Mandrake Linux Security Team <[EMAIL PROTECTED]> ________________________________________________________________________ Mandrake Linux Security Update Advisory ________________________________________________________________________ Package name: openssh Advisory ID: MDKSA-2002:040-1 Date: July 2nd, 2002 Original Advisory Date: June 24th, 2002 Affected versions: 7.1, 7.2, 8.0, 8.1, 8.2, Corporate Server 1.0.1, Single Network Firewall 7.2 ________________________________________________________________________ Problem Description: An input validation error exists in the OpenSSH server between versions 2.3.1 and 3.3 that can result in an integer overflow and privilege escalation. This error is found in the PAMAuthenticationViaKbdInt code in versions 2.3.1 to 3.3, and the ChallengeResponseAuthentication code in versions 2.9.9 to 3.3. OpenSSH 3.4 and later are not affected, and OpenSSH 3.2 and later prevent privilege escalation if UsePrivilegeSeparation is enabled; in OpenSSH 3.3 and higher this is the default behaviour of OpenSSH. To protect yourself, users should be using OpenSSH 3.3 with UsePrivilegeSeparation enabled (see MDKSA:2002-040). However, it is highly recommended that all Mandrake Linux users upgrade to version 3.4 which corrects these errors. There are a few caveats with this upgrade, however, that users should be aware of: - On Linux kernel 2.2 (the default for Mandrake Linux 7.x), the use of Compression and UsePrivilegeSeparation are mutually exclusive. You can use one feature or the other, not both; we recommend disabling Compression and using privsep until this can be resolved. - Using privsep may cause some PAM modules which expect to run with root privilege to fail. For instance, users will not be able to change their password if they attempt to log into an account with an expired password. If you absolutely must use one of these features that conflict with privsep, you can disable it in /etc/ssh/sshd_config by using: UsePrivilegeSeparation no However, if you do this, be sure you are running OpenSSH 3.4. Updates to OpenSSH will be made available once these problems are resolved. ________________________________________________________________________ References: http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=102495293705094&w=2 http://online.securityfocus.com/archive/1/280070/2002-06-29/2002-07-05/0 ________________________________________________________________________ Updated Packages: Linux-Mandrake 7.1: 75796ca71eb402f9857a9bf3831e740e 7.1/RPMS/openssh-3.4p1-1.2mdk.i586.rpm 817f59a4caa30308a4d98e7dba3bcc54 7.1/RPMS/openssh-askpass-3.4p1-1.2mdk.i586.rpm fbf725ecad88b921084404187849648a 7.1/RPMS/openssh-askpass-gnome-3.4p1-1.2mdk.i586.rpm d842f525ade248caea8ea418d232abc6 7.1/RPMS/openssh-clients-3.4p1-1.2mdk.i586.rpm b07c97c93bf04d48099024c7a70bae66 7.1/RPMS/openssh-server-3.4p1-1.2mdk.i586.rpm 2b059962de52e888584c0260e983cf19 7.1/SRPMS/openssh-3.4p1-1.2mdk.src.rpm Linux-Mandrake 7.2: a641fdf0dc7d21ad0aa5a4a9bc61729a 7.2/RPMS/openssh-3.4p1-1.2mdk.i586.rpm 0dad80e92b95d7b40d7758922c4bf858 7.2/RPMS/openssh-askpass-3.4p1-1.2mdk.i586.rpm fe7bbbef4078e47260a47c7cafb3d289 7.2/RPMS/openssh-askpass-gnome-3.4p1-1.2mdk.i586.rpm d88bb474b91125fbd65eb680b19298f0 7.2/RPMS/openssh-clients-3.4p1-1.2mdk.i586.rpm 45891af293f145f5a7029d77803b0e03 7.2/RPMS/openssh-server-3.4p1-1.2mdk.i586.rpm 2b059962de52e888584c0260e983cf19 7.2/SRPMS/openssh-3.4p1-1.2mdk.src.rpm Mandrake Linux 8.0: 0a719efcb863dca8871fba9caff3c262 8.0/RPMS/openssh-3.4p1-1.1mdk.i586.rpm c6f9e360811df656b8bac26544e24f5a 8.0/RPMS/openssh-askpass-3.4p1-1.1mdk.i586.rpm e83b5a1257b68d374965a3575f443374 8.0/RPMS/openssh-askpass-gnome-3.4p1-1.1mdk.i586.rpm eb55d0d7e67abf5fc76c3ec734583be3 8.0/RPMS/openssh-clients-3.4p1-1.1mdk.i586.rpm f89eaa623bc04bbbcaff435b729bb1fc 8.0/RPMS/openssh-server-3.4p1-1.1mdk.i586.rpm ae7d14d39519c7a8cf24fb972dabf64b 8.0/SRPMS/openssh-3.4p1-1.1mdk.src.rpm Mandrake Linux 8.0/ppc: fc49b66b4239b6973f6a87674bd5f0a1 ppc/8.0/RPMS/openssh-3.4p1-1.1mdk.ppc.rpm 4bbb740091f635cd30a4d65415cbb4fd ppc/8.0/RPMS/openssh-askpass-3.4p1-1.1mdk.ppc.rpm 2324f573ef5af591f6114111308ec302 ppc/8.0/RPMS/openssh-askpass-gnome-3.4p1-1.1mdk.ppc.rpm b0921af4b6468fa092364d107ae74438 ppc/8.0/RPMS/openssh-clients-3.4p1-1.1mdk.ppc.rpm 09cd66300f813b02b8fce596c6f41890 ppc/8.0/RPMS/openssh-server-3.4p1-1.1mdk.ppc.rpm ae7d14d39519c7a8cf24fb972dabf64b ppc/8.0/SRPMS/openssh-3.4p1-1.1mdk.src.rpm Mandrake Linux 8.1: 5e47e247a168672d615427ac6f61c3a6 8.1/RPMS/openssh-3.4p1-1.1mdk.i586.rpm 44c89f022f7c90f12368ff005d66c9ec 8.1/RPMS/openssh-askpass-3.4p1-1.1mdk.i586.rpm 44fe74f64e80e10381e3f45849cf6be2 8.1/RPMS/openssh-askpass-gnome-3.4p1-1.1mdk.i586.rpm fe3a4fd14350f127a294b876273a0f34 8.1/RPMS/openssh-clients-3.4p1-1.1mdk.i586.rpm 569aa9e54a78d43262160453c7ae49ae 8.1/RPMS/openssh-server-3.4p1-1.1mdk.i586.rpm ae7d14d39519c7a8cf24fb972dabf64b 8.1/SRPMS/openssh-3.4p1-1.1mdk.src.rpm Mandrake Linux 8.1/ia64: 5cc0fed5617222e4e634552e03a4d22e ia64/8.1/RPMS/openssh-3.4p1-1.1mdk.ia64.rpm 93807a0abdaed2616321ac6195d49526 ia64/8.1/RPMS/openssh-askpass-3.4p1-1.1mdk.ia64.rpm 89c005ac1d2688ad1ff5f4907dcc6fab ia64/8.1/RPMS/openssh-askpass-gnome-3.4p1-1.1mdk.ia64.rpm 0e1fb743c423e72a5a4c8337597ec84c ia64/8.1/RPMS/openssh-clients-3.4p1-1.1mdk.ia64.rpm 138c3d91c25d4b87a274dfae70ed848a ia64/8.1/RPMS/openssh-server-3.4p1-1.1mdk.ia64.rpm ae7d14d39519c7a8cf24fb972dabf64b ia64/8.1/SRPMS/openssh-3.4p1-1.1mdk.src.rpm Mandrake Linux 8.2: 7bedf2566a7b316ab6310f4423bcc19c 8.2/RPMS/openssh-3.4p1-1.1mdk.i586.rpm 75c38336dab4afe6e82f18027fd5d0d1 8.2/RPMS/openssh-askpass-3.4p1-1.1mdk.i586.rpm d2c1605bbbe408e11485024f0693d048 8.2/RPMS/openssh-askpass-gnome-3.4p1-1.1mdk.i586.rpm c887fa3ed238871954e4f699549dec38 8.2/RPMS/openssh-clients-3.4p1-1.1mdk.i586.rpm adbca15c1f900be940dca2bafb26c1a6 8.2/RPMS/openssh-server-3.4p1-1.1mdk.i586.rpm ae7d14d39519c7a8cf24fb972dabf64b 8.2/SRPMS/openssh-3.4p1-1.1mdk.src.rpm Mandrake Linux 8.2/ppc: 7a2a5a4a74c2e91dc360fe2cf6151989 ppc/8.2/RPMS/openssh-3.4p1-1.1mdk.ppc.rpm 7106102c019293674dc192afc09d1d88 ppc/8.2/RPMS/openssh-askpass-3.4p1-1.1mdk.ppc.rpm 697394feb5f4798f72d09b628958dad2 ppc/8.2/RPMS/openssh-askpass-gnome-3.4p1-1.1mdk.ppc.rpm d95119ce24e9956832b38127a7834203 ppc/8.2/RPMS/openssh-clients-3.4p1-1.1mdk.ppc.rpm dde7572585137865bcfd634dd1047963 ppc/8.2/RPMS/openssh-server-3.4p1-1.1mdk.ppc.rpm ae7d14d39519c7a8cf24fb972dabf64b ppc/8.2/SRPMS/openssh-3.4p1-1.1mdk.src.rpm Corporate Server 1.0.1: 75796ca71eb402f9857a9bf3831e740e 1.0.1/RPMS/openssh-3.4p1-1.2mdk.i586.rpm 817f59a4caa30308a4d98e7dba3bcc54 1.0.1/RPMS/openssh-askpass-3.4p1-1.2mdk.i586.rpm fbf725ecad88b921084404187849648a 1.0.1/RPMS/openssh-askpass-gnome-3.4p1-1.2mdk.i586.rpm d842f525ade248caea8ea418d232abc6 1.0.1/RPMS/openssh-clients-3.4p1-1.2mdk.i586.rpm b07c97c93bf04d48099024c7a70bae66 1.0.1/RPMS/openssh-server-3.4p1-1.2mdk.i586.rpm 2b059962de52e888584c0260e983cf19 1.0.1/SRPMS/openssh-3.4p1-1.2mdk.src.rpm Single Network Firewall 7.2: a641fdf0dc7d21ad0aa5a4a9bc61729a snf7.2/RPMS/openssh-3.4p1-1.2mdk.i586.rpm 0dad80e92b95d7b40d7758922c4bf858 snf7.2/RPMS/openssh-askpass-3.4p1-1.2mdk.i586.rpm fe7bbbef4078e47260a47c7cafb3d289 snf7.2/RPMS/openssh-askpass-gnome-3.4p1-1.2mdk.i586.rpm d88bb474b91125fbd65eb680b19298f0 snf7.2/RPMS/openssh-clients-3.4p1-1.2mdk.i586.rpm 45891af293f145f5a7029d77803b0e03 snf7.2/RPMS/openssh-server-3.4p1-1.2mdk.i586.rpm 2b059962de52e888584c0260e983cf19 snf7.2/SRPMS/openssh-3.4p1-1.2mdk.src.rpm ________________________________________________________________________ Bug IDs fixed (see https://qa.mandrakesoft.com for more information): ________________________________________________________________________ To upgrade automatically, use MandrakeUpdate. The verification of md5 checksums and GPG signatures is performed automatically for you. If you want to upgrade manually, download the updated package from one of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm". A list of FTP mirrors can be obtained from: http://www.mandrakesecure.net/en/ftp.php Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command: rpm --checksig <filename> All packages are signed by MandrakeSoft for security. You can obtain the GPG public key of the Mandrake Linux Security Team from: https://www.mandrakesecure.net/RPM-GPG-KEYS Please be aware that sometimes it takes the mirrors a few hours to update. You can view other update advisories for Mandrake Linux at: http://www.mandrakesecure.net/en/advisories/ MandrakeSoft has several security-related mailing list services that anyone can subscribe to. Information on these lists can be obtained by visiting: http://www.mandrakesecure.net/en/mlist.php If you want to report vulnerabilities, please contact [EMAIL PROTECTED] ________________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team <[EMAIL PROTECTED]> > Riccardo - -- bye miKe _______________________________________ Slackware 8.1 GNU/Linux 2.4.19 @ hp Xe3 R.U.#219755 - S.R.U.#705 - R.M.#110932 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE9h6DwF/9fksDJ4y0RAhCBAJ9lIjAczHiNuSRn5JiU+IuQeVxcgQCfa0YA BUYVgcH0NXiRm/bSdiM+m+s= =Q4VF -----END PGP SIGNATURE-----