Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 2164-1 OpenSSH SSHFP DNS Bypass - Critical Threat

ubuntu
Calendar Grey April 7, 2014
Scroller Ubuntu
Threatening servers may circumvent OpenSSH SSHFP DNS validation on Ubuntu. Upgrade OpenSSH to enhance your system's security.
A malicious server could bypass OpenSSH SSHFP DNS record checking.

Summary

A malicious server could bypass OpenSSH SSHFP DNS record checking.

Software Description:

- openssh: secure shell (SSH) for secure access to remote machines

Details:

Matthew Vernon discovered that OpenSSH did not correctly check SSHFP DNS

records if a server presented an unacceptable host certificate. A malicious

server could use this issue to disable SSHFP checking.

Topics%20covered

Topics Covered

security advisory openssh ubuntu dns bypass sshfp checking

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
  openssh-client                  1:6.2p2-6ubuntu0.3

Ubuntu 12.10:
  openssh-client                  1:6.0p1-3ubuntu1.2

Ubuntu 12.04 LTS:
  openssh-client                  1:5.9p1-5ubuntu1.3

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2164-1

CVE-2014-2653

Severity
critical
Lowest
Low
Medium
High
Critical

April 07, 2014

Topics%20covered

Topics Covered

security advisory openssh ubuntu dns bypass sshfp checking

Package Information

https://launchpad.net/ubuntu/+source/openssh/1:6.2p2-6ubuntu0.3
https://launchpad.net/ubuntu/+source/openssh/1:6.0p1-3ubuntu1.2
https://launchpad.net/ubuntu/+source/openssh/1:5.9p1-5ubuntu1.3

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.