Debian: 'ssh' Privilege escalation vulnerability

    Date05 Dec 2001
    CategoryDebian
    2561
    Posted ByLinuxSecurity Advisories
    If the UseLogin feature is enabled in for ssh local users couldpass environment variables (including variables like LD_PRELOAD)to the login process.
    
    ------------------------------------------------------------------------
    Debian Security Advisory DSA-091-1                   This email address is being protected from spambots. You need JavaScript enabled to view it. 
    http://www.debian.org/security/                         Wichert Akkerman
    December  5, 2001
    ------------------------------------------------------------------------
    
    
    Package        : ssh
    Problem type   : influencing login
    Debian-specific: no
    
    If the UseLogin feature is enabled in for ssh local users could
    pass environment variables (including variables like LD_PRELOAD)
    to the login process. This has been fixed by not copying the
    environment of UseLogin is enabled.
    
    Please note that the default configuration for Debian does not
    have the UseLogin enabled.
    
    This has been fixed in version 1:1.2.3-9.4.
    
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    
    Debian GNU/Linux 2.2 alias potato
    ---------------------------------
    
      Potato was released for alpha, arm, i386, m68k, powerpc and sparc.
    
      Source archives:
         http://security.debian.org/dists/stable/updates/main/source/openssh_1.2.3-9.4.diff.gz
          MD5 checksum: a3600ed331f986cf4c9e8999bc5d69cb
         http://security.debian.org/dists/stable/updates/main/source/openssh_1.2.3-9.4.dsc
          MD5 checksum: 30c2e9775b9bbb214afd95a731e0f482
         http://security.debian.org/dists/stable/updates/main/source/openssh_1.2.3.orig.tar.gz
          MD5 checksum: 6aad0cc9ceca55f138ed1ba4cf660349
    
      Architecture independent archives:
         
    http://security.debian.org/dists/stable/updates/main/binary-all/ssh-askpass-ptk_1.2.3-9.4_all.deb
          MD5 checksum: eb61f2cbd0a985ad91460676c54e8234
    
      Alpha architecture:
         
    http://security.debian.org/dists/stable/updates/main/binary-alpha/ssh-askpass-gnome_1.2.3-9.4_alpha.deb
          MD5 checksum: a1ff36aea22f0c93c6800fb1a282c15a
         http://security.debian.org/dists/stable/updates/main/binary-alpha/ssh_1.2.3-9.4_alpha.deb
          MD5 checksum: 5cae8437e415dd274d9de6ad86bd293a
    
      ARM architecture:
         
    http://security.debian.org/dists/stable/updates/main/binary-arm/ssh-askpass-gnome_1.2.3-9.4_arm.deb
          MD5 checksum: 5d5df2cda09d9edaf17c24d5cfe7c4a3
         http://security.debian.org/dists/stable/updates/main/binary-arm/ssh_1.2.3-9.4_arm.deb
          MD5 checksum: 88eaecbcf5f1e2a8fc4a1a5bffb7dad2
    
      Intel IA-32 architecture:
         
    http://security.debian.org/dists/stable/updates/main/binary-i386/ssh-askpass-gnome_1.2.3-9.4_i386.deb
          MD5 checksum: 174cc64dbb0996cd09d58f2691817dbf
         http://security.debian.org/dists/stable/updates/main/binary-i386/ssh_1.2.3-9.4_i386.deb
          MD5 checksum: 1426d1c8d424b8af6e94a1eec87075aa
    
      Motorola 680x0 architecture:
         
    http://security.debian.org/dists/stable/updates/main/binary-m68k/ssh-askpass-gnome_1.2.3-9.4_m68k.deb
          MD5 checksum: 78c897a689e04ffd20e1b0230b85f452
         http://security.debian.org/dists/stable/updates/main/binary-m68k/ssh_1.2.3-9.4_m68k.deb
          MD5 checksum: e0ca14452953a318dec512b739f8fec4
    
      PowerPC architecture:
         
    http://security.debian.org/dists/stable/updates/main/binary-powerpc/ssh-askpass-gnome_1.2.3-9.4_powerpc.deb
          MD5 checksum: 17bdb2cc2381defd4fb10bb963de9c19
         
    http://security.debian.org/dists/stable/updates/main/binary-powerpc/ssh_1.2.3-9.4_powerpc.deb
          MD5 checksum: 8f80b6a56f437589edbeb0ca2c3321e3
    
      Sun Sparc architecture:
         
    http://security.debian.org/dists/stable/updates/main/binary-sparc/ssh-askpass-gnome_1.2.3-9.4_sparc.deb
          MD5 checksum: a65d2465bb5372a5153b2c5afd4929ec
         http://security.debian.org/dists/stable/updates/main/binary-sparc/ssh_1.2.3-9.4_sparc.deb
          MD5 checksum: 687aa2c7dd8295b1c6bb0cac5d6c6c06
    
      These packages will be moved into the stable distribution on its next
      revision.
    
    For not yet released architectures please refer to the appropriate
    directory  ftp://ftp.debian.org/debian/dists/sid/binary-$arch/ .
    
    --
    ----------------------------------------------------------------------------
    apt-get: deb  http://security.debian.org/ stable/updates main
    dpkg-ftp:  ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    
    
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"5","type":"x","order":"1","pct":55.56,"resources":[]},{"id":"88","title":"Should be more technical","votes":"3","type":"x","order":"2","pct":33.33,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"1","type":"x","order":"3","pct":11.11,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    Advisories

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.