SOT Linux 2003 Advisory: openssh

[ Thanks to SOT Linux
Security Team for this link. ]

SOT Linux Security Advisory

1. Problem description

OpenSSH is a suite of network connectivity tools that can be
used to establish encrypted connections between systems on a
network and can provide interactive login sessions and port
forwarding, among other functions.

When configured to allow password-based or challenge-response
authentication, sshd (the OpenSSH server) uses PAM (Pluggable
Authentication Modules) to verify the user’s password. Under
certain conditions, OpenSSH versions prior to 3.6.1p1 reject an
invalid authentication attempt without first attempting
authentication using PAM.

If PAM is configured with its default failure delay, the amount
of time sshd takes to reject an invalid authentication request
varies widely enough that the timing variations could be used to
deduce whether or not an account with a specified name existed on
the server. This information could then be used to narrow the focus
of an attack against some other system component.

These updates contain backported fixes that cause sshd to always
attempt PAM authentication when performing password and
challenge-response authentication for clients.

2. Updated packages

SOT Linux 2003 Desktop:

i386:
ftp://ftp.sot.com/updates/2003/Desktop/i386/openssh-3.1p1-8.i386.rpm

ftp://ftp.sot.com/updates/2003/Desktop/i386/openssh-clients-3.1p1-8.i386.rpm

ftp://ftp.sot.com/updates/2003/Desktop/i386/openssh-server-3.1p1-8.i386.rpm

SRPMS:
ftp://ftp.sot.com/updates/2003/Desktop/SRPMS/openssh-3.1p1-8.src.rpm

SOT Linux 2003 Server:

i386:
ftp://ftp.sot.com/updates/2003/Server/i386/openssh-3.1p1-8.i386.rpm

ftp://ftp.sot.com/updates/2003/Server/i386/openssh-clients-3.1p1-8.i386.rpm

ftp://ftp.sot.com/updates/2003/Server/i386/openssh-server-3.1p1-8.i386.rpm

SRPMS:
ftp://ftp.sot.com/updates/2003/Server/SRPMS/openssh-3.1p1-8.src.rpm

3. Upgrading package

Before applying this update, make sure all previously released
errata relevant to your system have been applied.

Use up2date to automatically upgrade the fixed packages.

If you want to upgrade manually, download the updated package
from the SOT Linux FTP site (use the links above) or from one of
our mirrors. The list of mirrors can be obtained at
www.sot.com/en/linux

Update the package with the following command: rpm -Uvh
<filename>

4. Verification

All packages are PGP signed by SOT for security.

You can verify each package with the following command: rpm
–checksig <filename>

If you wish to verify the integrity of the downloaded package,
run “md5sum <filename>” and compare the output with data
given below.

Package Name MD5 sum

/Desktop/i386/openssh-3.1p1-8.i386.rpm
528261a6b209ddf33f97416bc48233e2
/Desktop/i386/openssh-clients-3.1p1-8.i386.rpm
7ce56a216741f0eb653ccac06f8373fe
/Desktop/i386/openssh-server-3.1p1-8.i386.rpm
4af79a74ef3d28a0f76bec6c15463eab
/Desktop/SRPMS/openssh-3.1p1-8.src.rpm
f62ffc55c8c3e545afe1a4f4a0f6c25b
/Server/i386/openssh-3.1p1-8.i386.rpm
528261a6b209ddf33f97416bc48233e2
/Server/i386/openssh-clients-3.1p1-8.i386.rpm
7ce56a216741f0eb653ccac06f8373fe
/Server/i386/openssh-server-3.1p1-8.i386.rpm
4af79a74ef3d28a0f76bec6c15463eab
/Server/SRPMS/openssh-3.1p1-8.src.rpm
f62ffc55c8c3e545afe1a4f4a0f6c25b

5. References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0190

Copyright(c) 2001-2003 SOT

You can view other update advisories for SOT Linux 2003 at:
http://www.sot.com/en/linux/sa/
To unsubscribe, visit your account at https://www.sot.com/