BugTraq
[slackware-security] openssh (SSA:2016-358-02) Dec 24 2016 01:35AM
Slackware Security Team (security slackware com)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security] openssh (SSA:2016-358-02)

New openssh packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1,
14.2, and -current to fix security issues.

Here are the details from the Slackware 14.2 ChangeLog:
+--------------------------+
patches/packages/openssh-7.4p1-i586-1_slack14.2.txz: Upgraded.
This is primarily a bugfix release, and also addresses security issues.
ssh-agent(1): Will now refuse to load PKCS#11 modules from paths outside
a trusted whitelist.
sshd(8): When privilege separation is disabled, forwarded Unix-domain
sockets would be created by sshd(8) with the privileges of 'root'.
sshd(8): Avoid theoretical leak of host private key material to
privilege-separated child processes via realloc().
sshd(8): The shared memory manager used by pre-authentication compression
support had a bounds checks that could be elided by some optimising
compilers to potentially allow attacks against the privileged monitor.
process from the sandboxed privilege-separation process.
sshd(8): Validate address ranges for AllowUser and DenyUsers directives at
configuration load time and refuse to accept invalid ones. It was
previously possible to specify invalid CIDR address ranges
(e.g. user (at) 127.1.2 (dot) 3 [email concealed]/55) and these would always match, possibly resulting
in granting access where it was not intended.
For more information, see:
https://www.openssh.com/txt/release-7.4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10009
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10010
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10011
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10012
(* Security fix *)
+--------------------------+

Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/op
enssh-7.4p1-i486-1_slack13.0.txz

Updated package for Slackware x86_64 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/
openssh-7.4p1-x86_64-1_slack13.0.txz

Updated package for Slackware 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/op
enssh-7.4p1-i486-1_slack13.1.txz

Updated package for Slackware x86_64 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/
openssh-7.4p1-x86_64-1_slack13.1.txz

Updated package for Slackware 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/o
penssh-7.4p1-i486-1_slack13.37.txz

Updated package for Slackware x86_64 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages
/openssh-7.4p1-x86_64-1_slack13.37.txz

Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/op
enssh-7.4p1-i486-1_slack14.0.txz

Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/
openssh-7.4p1-x86_64-1_slack14.0.txz

Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/op
enssh-7.4p1-i486-1_slack14.1.txz

Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/
openssh-7.4p1-x86_64-1_slack14.1.txz

Updated package for Slackware 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/op
enssh-7.4p1-i586-1_slack14.2.txz

Updated package for Slackware x86_64 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/
openssh-7.4p1-x86_64-1_slack14.2.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/open
ssh-7.4p1-i586-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/
openssh-7.4p1-x86_64-1.txz

MD5 signatures:
+-------------+

Slackware 13.0 package:
7fce1ebdb63b97beaeb98f450676171c openssh-7.4p1-i486-1_slack13.0.txz

Slackware x86_64 13.0 package:
26fbf1aa33f5b289b15435a904b5d2a0 openssh-7.4p1-x86_64-1_slack13.0.txz

Slackware 13.1 package:
5b8a87019ca527acba1f607af9175cfb openssh-7.4p1-i486-1_slack13.1.txz

Slackware x86_64 13.1 package:
29aa129063c2667612485edeac5c072b openssh-7.4p1-x86_64-1_slack13.1.txz

Slackware 13.37 package:
6d9aabce1fc85756b7863cbf1cf389a9 openssh-7.4p1-i486-1_slack13.37.txz

Slackware x86_64 13.37 package:
e57e264dccefc2621bd45838d96bb10d openssh-7.4p1-x86_64-1_slack13.37.txz

Slackware 14.0 package:
7613f561db6b8616ec2b0a283e4487d6 openssh-7.4p1-i486-1_slack14.0.txz

Slackware x86_64 14.0 package:
7a834d8b295da5ea88bac1340e359711 openssh-7.4p1-x86_64-1_slack14.0.txz

Slackware 14.1 package:
45c8e0c84e13d0c0a9914087898cefbd openssh-7.4p1-i486-1_slack14.1.txz

Slackware x86_64 14.1 package:
8e66d220fb2c3da97bf912a487436ac6 openssh-7.4p1-x86_64-1_slack14.1.txz

Slackware 14.2 package:
690e285ce2aeeee6f670451034ae3ec6 openssh-7.4p1-i586-1_slack14.2.txz

Slackware x86_64 14.2 package:
6a2b3846149a9f8071f2751aed452f53 openssh-7.4p1-x86_64-1_slack14.2.txz

Slackware -current package:
e0d8576b19ebe4da64f5d72474693295 n/openssh-7.4p1-i586-1.txz

Slackware x86_64 -current package:
1a8bbe8129a9c28fb9eb98b202646b46 n/openssh-7.4p1-x86_64-1.txz

Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg openssh-7.4p1-i586-1_slack14.2.txz

Next, restart the sshd daemon:
# sh /etc/rc.d/rc.sshd restart

+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security (at) slackware (dot) com [email concealed]

+-----------------------------------------------------------------------
-+
| To leave the slackware-security mailing list: |
+-----------------------------------------------------------------------
-+
| Send an email to majordomo (at) slackware (dot) com [email concealed] with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back containing instructions to |
| complete the process. Please do not reply to this email address. |
+-----------------------------------------------------------------------
-+
-----BEGIN PGP SIGNATURE-----

iEYEARECAAYFAlhd0CQACgkQakRjwEAQIjOtFACfWbK3WHi9hnOvSJgupjBdsrtE
e7MAn3rZ5dK+y872B6oqqF07GWTw5bBG
=3YjQ
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus