Alerts This Week
Warning Icon 1 560
Alerts This Week
Warning Icon 1 560

Slackware 12.0 SSA:2008-095-01 Critical: OpenSSH Hijack Issue

slackware
Calendar Grey April 4, 2008
Dist Slackware Esm H88
Recent updates for OpenSSH packages have been released for various versions of Slackware, aimed at resolving a significant security vulnerability.
New openssh packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, and -current to fix a security issue

Summary

Here are the details from the Slackware 12.0 ChangeLog: patches/packages/openssh-5.0p1-i486-1_slack12.0.tgz: Upgraded to openssh-5.0p1. This version fixes a security issue where local users could hijack forwarded X connections. Upgrading to the new package is highly recommended. For more information on this security issue, please see: https://www.cve.org/CVERecord?id=CVE-2008-1483 (* Security fix *)

Topics%20covered

Topics Covered

security advisory critical security fix Slackware OpenSSH remote login X forwarding

Where Find New Packages

HINT: Getting slow download speeds from ftp.slackware.com? Give slackware.osuosl.org a try. This is another primary FTP site for Slackware that can be considerably faster than downloading directly from ftp.slackware.com.
Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating additional FTP and rsync hosting to the Slackware project! :-)
Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you.
Updated package for Slackware 8.1: ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/openssh-5.0p1-i386-1_slack8.1.tgz
Updated package for Slackware 9.0: ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/openssh-5.0p1-i386-1_slack9.0.tgz
Updated package for Slackware 9.1: ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/openssh-5.0p1-i486-1_slack9.1.tgz
Updated package for Slackware 10.0: ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages...

Read the Full Advisory

MD5 Signatures

Slackware 8.1 package: 4a0e0f2293c98fd4ecb2049da7d6c0e7 openssh-5.0p1-i386-1_slack8.1.tgz
Slackware 9.0 package: c3e5e085a32c916517badda0ade062d6 openssh-5.0p1-i386-1_slack9.0.tgz
Slackware 9.1 package: 375d94c11692403d4ee5b4b051a21610 openssh-5.0p1-i486-1_slack9.1.tgz
Slackware 10.0 package: 4aba1ec2f602618ffdcbde3b249fb05f openssh-5.0p1-i486-1_slack10.0.tgz
Slackware 10.1 package: b0edcc0ef8a2de1a14c5492a04fdd931 openssh-5.0p1-i486-1_slack10.1.tgz
Slackware 10.2 package: 0335153a90308f17d83c0e3c24ccd9ee openssh-5.0p1-i486-1_slack10.2.tgz
Slackware 11.0 package: e675ba53b97892063ea77b4dfa80dce9 openssh-5.0p1-i486-1_slack11.0.tgz
Slackware 12.0 package: 0712943ea51957cefa9c53d7f74f12e4 openssh-5.0p1-i486-1_slack12.0.tgz
Slackware -current package: 0d22d793f4ce2ab68e9a9b5e9b893e3c openssh-5.0p1-i486-1.tgz

Severity
critical
Lowest
Low
Medium
High
Critical

Topics%20covered

Topics Covered

security advisory critical security fix Slackware OpenSSH remote login X forwarding

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Installation Instructions

Installation instructions: Upgrade the package as root: # upgradepkg openssh-5.0p1-i486-1_slack12.0.tgz IMPORTANT NOTE: Before restarting sshd (if you use it), be sure to move any new /etc/rc.d/rc.sshd into place: mv /etc/rc.d/rc.sshd.new /etc/rc.d/rc.sshd Then, make sure that the permissions are correct -- executable if you want sshd to start at boot, non-executable otherwise. Finally, restart sshd: sh /etc/rc.d/rc.sshd restart This will restart the listener process so that all new connections to sshd will connect to the new sshd, while old connections will not be dropped (and may be insecure until they are disconnected and reattached). Any users who are forwarding X connections through ssh should drop their connection and log in again.

Related News

Your message here