• info
• discussion
• exploit
• solution
• references

Multiple Portable OpenSSH PAM Vulnerabilities

Solution:
The vendor has released an updated package to address these issues.


OpenSSH OpenSSH 3.1 p1

• OpenSSH OpenSSH 3.7.1p2
  http://www.openssh.com/portable.html

OpenSSH OpenSSH 3.7 p1

• OpenPKG openssh-3.7.1p2-20030923.src.rpm
  ftp://ftp.openpkg.org/current/SRC/openssh-3.7.1p2-20030923.src.rpm


• OpenSSH OpenSSH 3.7.1p2
  http://www.openssh.com/portable.html


• Slackware openssh-3.7.1p2-i386-1.tgz
  Slackware 8.1
  ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/o penssh-3.7.1p2-i386-1.tgz


• Slackware openssh-3.7.1p2-i386-1.tgz
  Slackware 9.0
  ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/o penssh-3.7.1p2-i386-1.tgz


• TurboLinux openssh-3.7.1p2-1.i386.rpm
  Turbolinux Advanced Server 6
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/AdvancedServer /6/ja/updates/RPMS/openssh-3.7.1p2-1.i386.rpm


• TurboLinux openssh-3.7.1p2-1.i386.rpm
  Turbolinux Server 6.1
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/ updates/RPMS/openssh-3.7.1p2-1.i386.rpm


• TurboLinux openssh-3.7.1p2-1.i386.rpm
  Turbolinux 6.5 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.5/upd ates/RPMS/openssh-3.7.1p2-1.i386.rpm


• TurboLinux openssh-3.7.1p2-1.i386.rpm
  Turbolinux Workstation 6.0
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/6. 0/ja/updates/RPMS/openssh-3.7.1p2-1.i386.rpm


• TurboLinux openssh-3.7.1p2-1.i586.rpm
  Turbolinux 7 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updat es/RPMS/openssh-3.7.1p2-1.i586.rpm


• TurboLinux openssh-3.7.1p2-1.i586.rpm
  Turbolinux 8 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updat es/RPMS/openssh-3.7.1p2-1.i586.rpm


• TurboLinux openssh-3.7.1p2-1.i586.rpm
  Turbolinux 7 Workstation
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/ updates/RPMS/openssh-3.7.1p2-1.i586.rpm


• TurboLinux openssh-3.7.1p2-1.i586.rpm
  Turbolinux 8 Workstation
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/ updates/RPMS/openssh-3.7.1p2-1.i586.rpm


• TurboLinux openssh-askpass-3.7.1p2-1.i386.rpm
  Turbolinux Advanced Server 6
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/AdvancedServer /6/ja/updates/RPMS/openssh-askpass-3.7.1p2-1.i386.rpm


• TurboLinux openssh-askpass-3.7.1p2-1.i386.rpm
  Turbolinux 6.5 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.5/upd ates/RPMS/openssh-askpass-3.7.1p2-1.i386.rpm


• TurboLinux openssh-askpass-3.7.1p2-1.i386.rpm
  Turbolinux Workstation 6.0
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/6. 0/ja/updates/RPMS/openssh-askpass-3.7.1p2-1.i386.rpm


• TurboLinux openssh-askpass-3.7.1p2-1.i586.rpm
  Turbolinux 7 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updat es/RPMS/openssh-askpass-3.7.1p2-1.i586.rpm


• TurboLinux openssh-askpass-3.7.1p2-1.i586.rpm
  Turbolinux 8 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updat es/RPMS/openssh-askpass-3.7.1p2-1.i586.rpm


• TurboLinux openssh-askpass-3.7.1p2-1.i586.rpm
  Turbolinux 7 Workstation
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/ updates/RPMS/openssh-askpass-3.7.1p2-1.i586.rpm


• TurboLinux openssh-askpass-3.7.1p2-1.i586.rpm
  Turbolinux 8 Workstation
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/ updates/RPMS/openssh-askpass-3.7.1p2-1.i586.rpm


• TurboLinux openssh-askpass-gnome-3.7.1p2-1.i386.rpm
  Turbolinux Advanced Server 6
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/AdvancedServer /6/ja/updates/RPMS/openssh-askpass-gnome-3.7.1p2-1.i386.rpm


• TurboLinux openssh-askpass-gnome-3.7.1p2-1.i386.rpm
  Turbolinux Server 6.1
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/ updates/RPMS/openssh-askpass-gnome-3.7.1p2-1.i386.rpm


• TurboLinux openssh-askpass-gnome-3.7.1p2-1.i386.rpm
  Turbolinux Workstation 6.0
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/6. 0/ja/updates/RPMS/openssh-askpass-gnome-3.7.1p2-1.i386.rpm


• TurboLinux openssh-askpass-gnome-3.7.1p2-1.i586.rpm
  Turbolinux 8 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updat es/RPMS/openssh-askpass-gnome-3.7.1p2-1.i586.rpm


• TurboLinux openssh-clients-3.7.1p2-1.i386.rpm
  Turbolinux Advanced Server 6
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/AdvancedServer /6/ja/updates/RPMS/openssh-clients-3.7.1p2-1.i386.rpm


• TurboLinux openssh-clients-3.7.1p2-1.i386.rpm
  Turbolinux Server 6.1
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/ updates/RPMS/openssh-clients-3.7.1p2-1.i386.rpm


• TurboLinux openssh-clients-3.7.1p2-1.i386.rpm
  Turbolinux 6.5 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.5/upd ates/RPMS/openssh-clients-3.7.1p2-1.i386.rpm


• TurboLinux openssh-clients-3.7.1p2-1.i386.rpm
  Turbolinux Workstation 6.0
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/6. 0/ja/updates/RPMS/openssh-clients-3.7.1p2-1.i386.rpm


• TurboLinux openssh-clients-3.7.1p2-1.i586.rpm
  Turbolinux 7 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updat es/RPMS/openssh-clients-3.7.1p2-1.i586.rpm


• TurboLinux openssh-clients-3.7.1p2-1.i586.rpm
  Turbolinux 8 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updat es/RPMS/openssh-clients-3.7.1p2-1.i586.rpm


• TurboLinux openssh-clients-3.7.1p2-1.i586.rpm
  Turbolinux 7 Workstation
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/ updates/RPMS/openssh-clients-3.7.1p2-1.i586.rpm


• TurboLinux openssh-clients-3.7.1p2-1.i586.rpm
  Turbolinux 8 Workstation
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/ updates/RPMS/openssh-clients-3.7.1p2-1.i586.rpm


• TurboLinux openssh-server-3.7.1p2-1.i386.rpm
  Turbolinux Advanced Server 6
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/AdvancedServer /6/ja/updates/RPMS/openssh-server-3.7.1p2-1.i386.rpm


• TurboLinux openssh-server-3.7.1p2-1.i386.rpm
  Turbolinux Server 6.1
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/ updates/RPMS/openssh-server-3.7.1p2-1.i386.rpm


• TurboLinux openssh-server-3.7.1p2-1.i386.rpm
  Turbolinux 6.5 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.5/upd ates/RPMS/openssh-server-3.7.1p2-1.i386.rpm


• TurboLinux openssh-server-3.7.1p2-1.i386.rpm
  Turbolinux Workstation 6.0
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/6. 0/ja/updates/RPMS/openssh-server-3.7.1p2-1.i386.rpm


• TurboLinux openssh-server-3.7.1p2-1.i586.rpm
  Turbolinux 7 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updat es/RPMS/openssh-server-3.7.1p2-1.i586.rpm


• TurboLinux openssh-server-3.7.1p2-1.i586.rpm
  Turbolinux 8 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updat es/RPMS/openssh-server-3.7.1p2-1.i586.rpm


• TurboLinux openssh-server-3.7.1p2-1.i586.rpm
  Turbolinux 7 Workstation
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/ updates/RPMS/openssh-server-3.7.1p2-1.i586.rpm


• TurboLinux openssh-server-3.7.1p2-1.i586.rpm
  Turbolinux 8 Workstation
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/ updates/RPMS/openssh-server-3.7.1p2-1.i586.rpm

OpenSSH OpenSSH 3.7.1 p1

• OpenPKG openssh-3.7.1p2-20030923.src.rpm
  ftp://ftp.openpkg.org/current/SRC/openssh-3.7.1p2-20030923.src.rpm


• OpenSSH OpenSSH 3.7.1p2
  http://www.openssh.com/portable.html


• SCO VOL.000.000
  ftp://ftp.sco.com/pub/updates/OpenServer/CSSA-2003-SCO.24/VOL.000.000


• SCO VOL.000.001
  ftp://ftp.sco.com/pub/updates/OpenServer/CSSA-2003-SCO.24/VOL.000.001


• SCO VOL.000.002
  ftp://ftp.sco.com/pub/updates/OpenServer/CSSA-2003-SCO.24/VOL.000.002


• SCO VOL.000.003
  ftp://ftp.sco.com/pub/updates/OpenServer/CSSA-2003-SCO.24/VOL.000.003


• Slackware openssh-3.7.1p2-i386-1.tgz
  Slackware 8.1
  ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/o penssh-3.7.1p2-i386-1.tgz


• Slackware openssh-3.7.1p2-i386-1.tgz
  Slackware 9.0
  ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/o penssh-3.7.1p2-i386-1.tgz


• TurboLinux openssh-3.7.1p2-1.i386.rpm
  Turbolinux Advanced Server 6
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/AdvancedServer /6/ja/updates/RPMS/openssh-3.7.1p2-1.i386.rpm


• TurboLinux openssh-3.7.1p2-1.i386.rpm
  Turbolinux Server 6.1
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/ updates/RPMS/openssh-3.7.1p2-1.i386.rpm


• TurboLinux openssh-3.7.1p2-1.i386.rpm
  Turbolinux 6.5 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.5/upd ates/RPMS/openssh-3.7.1p2-1.i386.rpm


• TurboLinux openssh-3.7.1p2-1.i386.rpm
  Turbolinux Workstation 6.0
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/6. 0/ja/updates/RPMS/openssh-3.7.1p2-1.i386.rpm


• TurboLinux openssh-3.7.1p2-1.i586.rpm
  Turbolinux 7 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updat es/RPMS/openssh-3.7.1p2-1.i586.rpm


• TurboLinux openssh-3.7.1p2-1.i586.rpm
  Turbolinux 8 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updat es/RPMS/openssh-3.7.1p2-1.i586.rpm


• TurboLinux openssh-3.7.1p2-1.i586.rpm
  Turbolinux 7 Workstation
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/ updates/RPMS/openssh-3.7.1p2-1.i586.rpm


• TurboLinux openssh-3.7.1p2-1.i586.rpm
  Turbolinux 8 Workstation
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/ updates/RPMS/openssh-3.7.1p2-1.i586.rpm


• TurboLinux openssh-askpass-3.7.1p2-1.i386.rpm
  Turbolinux Advanced Server 6
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/AdvancedServer /6/ja/updates/RPMS/openssh-askpass-3.7.1p2-1.i386.rpm


• TurboLinux openssh-askpass-3.7.1p2-1.i386.rpm
  Turbolinux 6.5 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.5/upd ates/RPMS/openssh-askpass-3.7.1p2-1.i386.rpm


• TurboLinux openssh-askpass-3.7.1p2-1.i386.rpm
  Turbolinux Workstation 6.0
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/6. 0/ja/updates/RPMS/openssh-askpass-3.7.1p2-1.i386.rpm


• TurboLinux openssh-askpass-3.7.1p2-1.i586.rpm
  Turbolinux 7 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updat es/RPMS/openssh-askpass-3.7.1p2-1.i586.rpm


• TurboLinux openssh-askpass-3.7.1p2-1.i586.rpm
  Turbolinux 8 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updat es/RPMS/openssh-askpass-3.7.1p2-1.i586.rpm


• TurboLinux openssh-askpass-3.7.1p2-1.i586.rpm
  Turbolinux 7 Workstation
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/ updates/RPMS/openssh-askpass-3.7.1p2-1.i586.rpm


• TurboLinux openssh-askpass-3.7.1p2-1.i586.rpm
  Turbolinux 8 Workstation
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/ updates/RPMS/openssh-askpass-3.7.1p2-1.i586.rpm


• TurboLinux openssh-askpass-gnome-3.7.1p2-1.i386.rpm
  Turbolinux Advanced Server 6
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/AdvancedServer /6/ja/updates/RPMS/openssh-askpass-gnome-3.7.1p2-1.i386.rpm


• TurboLinux openssh-askpass-gnome-3.7.1p2-1.i386.rpm
  Turbolinux Server 6.1
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/ updates/RPMS/openssh-askpass-gnome-3.7.1p2-1.i386.rpm


• TurboLinux openssh-askpass-gnome-3.7.1p2-1.i386.rpm
  Turbolinux Workstation 6.0
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/6. 0/ja/updates/RPMS/openssh-askpass-gnome-3.7.1p2-1.i386.rpm


• TurboLinux openssh-askpass-gnome-3.7.1p2-1.i586.rpm
  Turbolinux 8 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updat es/RPMS/openssh-askpass-gnome-3.7.1p2-1.i586.rpm


• TurboLinux openssh-clients-3.7.1p2-1.i386.rpm
  Turbolinux Advanced Server 6
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/AdvancedServer /6/ja/updates/RPMS/openssh-clients-3.7.1p2-1.i386.rpm


• TurboLinux openssh-clients-3.7.1p2-1.i386.rpm
  Turbolinux Server 6.1
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/ updates/RPMS/openssh-clients-3.7.1p2-1.i386.rpm


• TurboLinux openssh-clients-3.7.1p2-1.i386.rpm
  Turbolinux 6.5 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.5/upd ates/RPMS/openssh-clients-3.7.1p2-1.i386.rpm


• TurboLinux openssh-clients-3.7.1p2-1.i386.rpm
  Turbolinux Workstation 6.0
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/6. 0/ja/updates/RPMS/openssh-clients-3.7.1p2-1.i386.rpm


• TurboLinux openssh-clients-3.7.1p2-1.i586.rpm
  Turbolinux 7 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updat es/RPMS/openssh-clients-3.7.1p2-1.i586.rpm


• TurboLinux openssh-clients-3.7.1p2-1.i586.rpm
  Turbolinux 8 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updat es/RPMS/openssh-clients-3.7.1p2-1.i586.rpm


• TurboLinux openssh-clients-3.7.1p2-1.i586.rpm
  Turbolinux 7 Workstation
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/ updates/RPMS/openssh-clients-3.7.1p2-1.i586.rpm


• TurboLinux openssh-clients-3.7.1p2-1.i586.rpm
  Turbolinux 8 Workstation
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/ updates/RPMS/openssh-clients-3.7.1p2-1.i586.rpm


• TurboLinux openssh-server-3.7.1p2-1.i386.rpm
  Turbolinux Advanced Server 6
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/AdvancedServer /6/ja/updates/RPMS/openssh-server-3.7.1p2-1.i386.rpm


• TurboLinux openssh-server-3.7.1p2-1.i386.rpm
  Turbolinux Server 6.1
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.1/ja/ updates/RPMS/openssh-server-3.7.1p2-1.i386.rpm


• TurboLinux openssh-server-3.7.1p2-1.i386.rpm
  Turbolinux 6.5 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/6.5/upd ates/RPMS/openssh-server-3.7.1p2-1.i386.rpm


• TurboLinux openssh-server-3.7.1p2-1.i386.rpm
  Turbolinux Workstation 6.0
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/6. 0/ja/updates/RPMS/openssh-server-3.7.1p2-1.i386.rpm


• TurboLinux openssh-server-3.7.1p2-1.i586.rpm
  Turbolinux 7 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updat es/RPMS/openssh-server-3.7.1p2-1.i586.rpm


• TurboLinux openssh-server-3.7.1p2-1.i586.rpm
  Turbolinux 8 Server
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updat es/RPMS/openssh-server-3.7.1p2-1.i586.rpm


• TurboLinux openssh-server-3.7.1p2-1.i586.rpm
  Turbolinux 7 Workstation
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/ updates/RPMS/openssh-server-3.7.1p2-1.i586.rpm


• TurboLinux openssh-server-3.7.1p2-1.i586.rpm
  Turbolinux 8 Workstation
  ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/ updates/RPMS/openssh-server-3.7.1p2-1.i586.rpm