Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found -2 articles for you...
197
security advisorydenial of serviceDebianDebian 8: DLA-1858-1 High Severity: Squid3 Denial of Service Issue
Squid, a high-performance proxy caching server for web clients, has been found vulnerable to denial of service attacks associated with HTTP authentication header processing. . Package : squid3 Version : 3.4.8-6+deb8u8 CVE ID : CVE-2019-12525 CVE-2019-12529 Squid, a high-performance proxy caching server for web clients, has been found vulnerable to denial of service attacks associated with HTTP authentication header processing. CVE-2019-12525 Due to incorrect buffer management Squid is vulnerable to a denial of service attack when processing HTTP Digest Authentication credentials. Due to incorrect input validation the HTTP Request header parser for Digest authentication may access memory outside the allocated memory buffer. On systems with memory access protections this can result in the Squid process being terminated unexpectedly. Resulting in a denial of service for all clients using the proxy. CVE-2019-12529 Due to incorrect buffer management Squid is vulnerable to a denial of service attack when processing HTTP Basic Authentication credentials. Due to incorrect string termination the Basic authentication credentials decoder may access memory outside the decode buffer. On systems with memory access protections this can result in the Squid process being terminated unexpectedly. Resulting in a denial of service for all clients using the proxy. For Debian 8 "Jessie", these problems have been fixed in version 3.4.8-6+deb8u8. We recommend that you upgrade your squid3 packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . The latest Squid3 revision resolves potential denial of service vulnerabilities linked to buffer management in HTTP auth processes.. squid3, denial of service, Debian LTS, security update. . LinuxSecurity.com Team
Jul 20, 2019
Debian LTS
100
security advisorySuSEremote accessSuSE: 2003:039 Critical Alert: OpenSSH Remote Access Exploit
A programming error has been found in code responsible for buffer management.. ______________________________________________________________________________ SuSE Security Announcement Package: openssh (second release) Announcement-ID: SuSE-SA:2003:039 Date: Thursday, Sep 18 2003 20:00 MEST Affected products: 7.2, 7.3, 8.0, 8.1, 8.2 SuSE Linux Database Server, SuSE eMail Server III, 3.1 SuSE Linux Enterprise Server 7, 8 SuSE Linux Firewall on CD/Admin host SuSE Linux Connectivity Server SuSE Linux Office Server SuSE Linux Standard Server 8 Vulnerability Type: potential remote privilege escalation Severity (1-10): 8 SuSE default package: yes Cross References: openssh CERTVU#333628 cert CVE CAN-2003-0693 CVE CAN-2003-0695 CVE CAN-2003-0682 Content of this advisory: 1) security vulnerability resolved: openssh problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds: - mysql 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The openssh package is the most widely used implementation of the secure shell protocol family (ssh). It provides a set of network connectivity tools for remote (shell) login, designed to substitute the traditional BSD-style r-protocols (rsh, rlogin). openssh has various authentification mechanisms andmany other features such as TCP connection and X11 display forwarding over the fully encrypted network connection as well as file transfer facilities. This is a new release of SuSE Security Announcement (openssh), ID SuSE-SA:2003:038. A set of new bugs were addressed by the openssh development team. These bugs are fixed in the new 3.7.1 upstream release of the openssh package; we have added the necessary changes to our packages preserving the package version to avoid the risk of incompatible behaviour of the software. Specifics about the errors found: (Topic for SuSE Security Announcement SuSE-SA:2003:038:) A programming error has been found in code responsible for buffer management. If exploited by a (remote) attacker, the error may lead to unauthorized access to the system, allowing the execution of arbitrary commands. The error is known as the buffer_append_space()-bug and is assigned the Common Vulnerabilities and Exposures (CVE) name CAN-2003-0693. The error was cause for the upstream release openssh-3.7. (Topic for SuSE Security Announcement SuSE-SA:2003:039 (this announcement):) Programming errors of a similar kind as described above have been found in other portions of the code, with similar effects. These errors are known as "buffer.c/channels.c bug", the CVE name for these errors is CAN-2003-0695. This set of errors was cause for the upstream release openssh-3.7.1. In addition to the fixes for the buffer.c/channels.c bugs we have added some changes that have been assembled by Solar Designer during his review of the source code. These fixes are considered a precautious measure and are not believed to have a significant effect on the security of the openssh code. At the time of writing this announcement, we believe that at least one set of errors as described above is exploitable by a remote attacker. As a reminder, at the time of writing the SuSE Security Announcement SuSE-SA:2003:038 it was unclear if the bug addressed with the announcement (buffer_append_space()-bug) is exploitable. An increasing amount of TCP connection attempts to port 22 as observed in the internet during the past days may indicate that there exists an exploit for the error in the public. Please note that we have disabled the Privilege Separation feature in the ssh daemon (sshd) with this update. The PrivSep feature is designed to have parts of the ssh daemon's work running under lowered privileges, thereby limiting the effect of a possible vulnerability in the code. The PrivSep feature is turned on/off by the UsePrivilegeSeparation keyword in sshd's configuration file /etc/ssh/sshd_config. The feature is held responsible for malfunctions in PAM (Pluggable Authentification Modules). The update mechanism will not overwrite configuration files that have been altered after the package installation. SPECIAL INSTALL INSTRUCTIONS: ============================= After the update has been successfully applied, the ssh daemon (sshd) must be restarted for update package to become effective. To restart the ssh daemon after the update, please run the following command as root: rcsshd restart Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. Intel i386 Platform: SuSE-8.2: e030b0803481d0f29f576e3b4726284f patch rpm(s): d022894363b99e6bd03e9b2109c2244c source rpm(s): 3f7f5ed43c7d795c63fe06148874944a SuSE-8.1: 91cdd33a4149756b8f6371aa3177a5f4 patch rpm(s): 3b7c44819c8fed5e33514481d99d4ab7 source rpm(s): 6c3694fc75bcf185035547b85abbc491 SuSE-8.0: c61781b97767188cc3a39795535307ff patch rpm(s): c222aef79a8fef6d44d8d61fc075efc5 source rpm(s): bc327a4150058c9d1216cb96712973a5 SuSE-7.3: c9928c04b03cb292aa96ad6890a5ee38 source rpm(s): 28aa82be9233e3ba93b94eb138c9ea04 SuSE-7.2: b369724a788a2c6bd70a448a49530f69 source rpm(s): 98b8b7281fe04aab8c8838adcf195697 Sparc Platform: SuSE-7.3: 97cb0218e9354b8cc062e44a0d6fb19f source rpm(s): 8cddb96e633864469d7ba08d3cf7436a PPC Power PC Platform: SuSE-7.3: 37b1e82a3971f5c4c427ce37227b11e0 source rpm(s): 7a19424887772b86d14bacbf5add9628 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - A buffer overflow vulnerability has been found in the mysql package, an Open Source relational database system. The error may allow a remote attacker to execute arbitrary code with the privileges of the database process. We are in the process of building and testing the update packages and will release them with a SuSE Security Announcement as soon as possible. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographicallysigned) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key
Sep 18, 2003
•Critical
SuSE
99
security advisoryremote exploitcriticalSlackware: SSA:2003-260-01 Critical: OpenSSH Buffer Management Exploit
These packages fix additional buffer managementerrors that were not corrected in the recent 3.7p1 release.. [slackware-security] OpenSSH updated again (SSA:2003-260-01) Upgraded OpenSSH 3.7.1p1 packages are available for Slackware 8.1, 9.0 and -current. These fix additional buffer management errors that were not corrected in the recent 3.7p1 release. The possibility exists that these errors could allow a remote exploit, so we recommend all sites running OpenSSH upgrade to the new OpenSSH package immediately. Here are the details from the Slackware 9.0 ChangeLog: +--------------------------+ Wed Sep 17 01:25:22 PDT 2003 patches/packages/openssh-3.7.1p1-i386-1.tgz: Upgraded to openssh-3.7.1p1. The OpenSSH advisory was updated (https://www.openssh.org/txt/buffer.adv) and now says that you need at least version 3.7.1, which fixes some more buffer problems like those fixed by 3.7. (* Security fix *) +--------------------------+ WHERE TO FIND THE NEW PACKAGES: +-----------------------------+ Updated package for Slackware 8.1: Updated package for Slackware 9.0: Updated package for Slackware -current: MD5 SIGNATURES: +-------------+ Slackware 8.1 package: c3b50ac3f2cd52c7ad10a0fbb141efe9 openssh-3.7.1p1-i386-1.tgz Slackware 9.0 package: 0362f59c065c79c3eb733519394d0a60 openssh-3.7.1p1-i386-1.tgz Slackware -current package: e6e9cb0a9811f982d615e7a96c6c76e9 openssh-3.7.1p1-i486-1.tgz INSTALLATION INSTRUCTIONS: +------------------------+ (This procedure is safe to do while logged in through OpenSSH) Upgrade using upgradepkg (as root): # upgradepkg openssh-3.7.1p1-i386-1.tgz Restart OpenSSH: . /etc/rc.d/rc.sshd restart +-----+ Slackware Linux Security Team slackware
Sep 17, 2003
•Critical
Slackware
100
security advisorycriticalprivilege escalationSUSE: 2003:039 Severe: OpenSSL Certificate Handling Vulnerability
A programming error has been found in code responsible for buffer management. If exploited by a (remote) attacker, the error may lead to unauthorized access to the system, allowing the execution of arbitrary commands.. ______________________________________________________________________________ SuSE Security Announcement Package: openssh Announcement-ID: SuSE-SA:2003:038 Date: Tuesday, Sep 16 2003 22:15 MEST Affected products: 7.2, 7.3, 8.0, 8.1, 8.2 SuSE Linux Database Server, SuSE eMail Server III, 3.1 SuSE Linux Enterprise Server 7, 8 SuSE Linux Firewall on CD/Admin host SuSE Linux Connectivity Server SuSE Linux Office Server SuSE Linux Standard Server 8 Vulnerability Type: potential remote privilege escalation Severity (1-10): 8 SuSE default package: yes Cross References: openssh CERT VU#333628 CVE CAN-2003-0693 Content of this advisory: 1) security vulnerability resolved: openssh problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds: - mysql 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The openssh package is the most widely used implementation of the secure shell protocol family (ssh). It provides a set of network connectivity tools for remote (shell) login, designed to substitute the traditional BSD-style r-protocols (rsh, rlogin). openssh has various authentification mechanisms and many other features such as TCP connection and X11 display forwarding over the fully encrypted network connection as well as file transfer facilities. A programming error has been found in code responsible for buffer management. If exploited by a (remote) attacker, the error may lead to unauthorized access to the system, allowing the execution of arbitrary commands. The error is known as the buffer_append_space()-bug and is assigned the Common Vulnerabilities and Exposures (CVE) name CAN-2003-0693. At the time of writing this announcement, it is unclear if the buffer_append_space()-bug is exploitable. However, an increasing amount of TCP connection attempts to port 22 (the ssh default port) has been observed in the internet during the past days, which may indicate that there exists an exploit for the error. Please note that we have disabled the Privilege Separation feature in the ssh daemon (sshd) with this update. The PrivSep feature is designed to have parts of the ssh daemon's work running under lowered privileges, thereby limiting the effect of a possible vulnerability in the code. The PrivSep feature is turned on/off by the UsePrivilegeSeparation keyword in sshd's configuration file /etc/ssh/sshd_config. The feature is held responsible for malfunctions in PAM (Pluggable Authentification Modules). The update mechanism will not overwrite configuration files that have been altered after the package installation. SPECIAL INSTALL INSTRUCTIONS: ============================= After the update has been successfully applied, the ssh daemon (sshd) must be restarted for update package to become effective. To restart the ssh daemon after the update, please run the following command as root: rcsshd restart Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package usingthe command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. Intel i386 Platform: SuSE-8.2: 492d66deaedcfc20c1f0d66e508db790 patch rpm(s): c362fedfda79824cb40cd4e5e1055aee source rpm(s): 0381b9b4818f8b669631bcab9be80fb5 SuSE-8.1: dda7728501c8cf17c60eff1862922842 patch rpm(s): d02dfc049413b725c4255887487cfa67 source rpm(s): 26dd44e9bed7a5ad2d35e56301dc5489 SuSE-8.0: 2361dccd5b0c83178f8d0d5988b3490e patch rpm(s): 5bef6aff5a603e3376a2f907c494ea7e source rpm(s): 203aab39cdb7c5672a82bb07bc4a1f38 SuSE-7.3: 1418135ed33e59d1ce37ea135617b5bc source rpm(s): 9d0b789127d30cca9f45c7b1f2268673 SuSE-7.2: e807ecd9c4d167e3ef3764c06af1a511 source rpm(s): a99aa03ba94f45dd25054b1ab1a962d7 Sparc Platform: SuSE-7.3: e4f9b7e8763464d60761faf94b7f80f9 source rpm(s): ca0cbe5b564b03c64458868db369c4de PPC Power PC Platform: SuSE-7.3: 0166ec0aec482b687bc2891611ae8ae9 source rpm(s): aed7879361a85f263a1cb3a00de964a1 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - A buffer overflow vulnerability has been found in the mysql package, an Open Source relational database system. The error may allow a remote attacker to execute arbitrary code with the privileges of the database process. We are in the process of building and testing the update packages and will release them with a SuSE Security Announcement as soon as possible. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information -Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key
Sep 16, 2003
•Critical
SuSE
99
security advisoryremote exploitcriticalSlackware: SSA-2003-259-01 Critical: OpenSSH Buffer Error Exploit
These fix a buffer management error found in versions ofOpenSSH earlier than 3.7. The possibility exists that this errorcould allow a remote exploit, so we recommend all sites runningOpenSSH upgrade to the new OpenSSH package immediately.. [slackware-security] OpenSSH Security Advisory (SSA:2003-259-01) Upgraded OpenSSH packages are available for Slackware 8.1, 9.0 and -current. These fix a buffer management error found in versions of OpenSSH earlier than 3.7. The possibility exists that this error could allow a remote exploit, so we recommend all sites running OpenSSH upgrade to the new OpenSSH package immediately. Here are the details from the Slackware 9.0 ChangeLog: +--------------------------+ Tue Sep 16 11:13:05 PDT 2003 patches/packages/openssh-3.7p1-i386-1.tgz: Upgraded to openssh-3.7p1. From the OpenSSH Security Advisory (https://www.openssh.org/txt/buffer.adv): "All versions of OpenSSH's sshd prior to 3.7 contain a buffer management error. It is uncertain whether this error is potentially exploitable, however, we prefer to see bugs fixed proactively." (* Security fix *) +--------------------------+ WHERE TO FIND THE NEW PACKAGES: +-----------------------------+ Updated package for Slackware 8.1: Updated package for Slackware 9.0: Updated package for Slackware -current: MD5 SIGNATURES: +-------------+ Slackware 8.1 package: a86d410e47fe8ab4a8e9f04293a94093 openssh-3.7p1-i386-1.tgz Slackware 9.0 package: ca1d0b1e658c5391067f2a9cf11fc239 openssh-3.7p1-i386-1.tgz Slackware -current package: c58003eaaf4362c8475f0f5a77f2adbb openssh-3.7p1-i486-1.tgz INSTALLATION INSTRUCTIONS: +------------------------+ (This procedure is safe to do while logged in through OpenSSH) Upgrade using upgradepkg (as root): # upgradepkg openssh-3.7p1-i386-1.tgz Restart OpenSSH: . /etc/rc.d/rc.sshd restart +-----+ Slackware Linux Security Team slackware
Sep 16, 2003
•Critical
Slackware
91
security advisoryGentooremote exploitGentoo: 200309-11 Critical: OpenSSH Buffer Management Error
ll versions of OpenSSH's sshd prior to 3.7 contain a buffer managementerror. It is uncertain whether this error is potentially exploitable,however, we prefer to see bugs fixed proactively.. - - --------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200309-11 - - --------------------------------------------------------------------- PACKAGE : openssh SUMMARY : buffer management error DATE : 2003-09-16 22:53 UTC EXPLOIT : remote VERSIONS AFFECTED : =openssh-3.7_p1 CVE : CAN-2003-0693 - - --------------------------------------------------------------------- quote from advisory: "All versions of OpenSSH's sshd prior to 3.7 contain a buffer management error. It is uncertain whether this error is potentially exploitable, however, we prefer to see bugs fixed proactively." read the full advisory at: openssh SOLUTION It is recommended that all Gentoo Linux users who are running net-misc/openssh upgrade to openssh-3.7_p1 as follows: emerge sync emerge openssh emerge clean - - ---------------------------------------------------------------------
Sep 16, 2003
•Critical
Gentoo
98
security advisoryremote exploitred hatRed Hat Linux: RHSA-2003:279-01 Critical Remote Exploit in OpenSSH
A bug has been found in OpenSSH's buffer handling where a buffer could be marked as grown when the actual reallocation failed.. - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Updated OpenSSH packages fix potential vulnerability Advisory ID: RHSA-2003:279-01 Issue date: 2003-09-16 Updated on: 2003-09-16 Product: Red Hat Linux Keywords: Cross references: Obsoletes: RHSA-2003:222 CVE Names: CAN-2003-0693 - --------------------------------------------------------------------- 1. Topic: Updated OpenSSH packages are now available that fix a bug that may be remotely exploitable. 2. Relevant releases/architectures: Red Hat Linux 7.1 - i386 Red Hat Linux 7.2 - i386, ia64 Red Hat Linux 7.3 - i386 Red Hat Linux 8.0 - i386 Red Hat Linux 9 - i386 3. Problem description: OpenSSH is a suite of network connectivity tools that can be used to establish encrypted connections between systems on a network and can provide interactive login sessions and port forwarding, among other functions. The OpenSSH team has announced a bug which affects the OpenSSH buffer handling code. This bug has the potential of being remotely exploitable. All users of OpenSSH should immediately apply this update which contains a backported fix for this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. Touse Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. If up2date fails to connect to Red Hat Network due to SSL Certificate Errors, you need to install a version of the up2date client with an updated certificate. The latest version of up2date is available from the Red Hat FTP site and may also be downloaded directly from the RHN website: 5. RPMs required: Red Hat Linux 7.1: SRPMS: i386: Red Hat Linux 7.2: SRPMS: i386: ia64: Red Hat Linux 7.3: SRPMS: i386: Red Hat Linux 8.0: SRPMS: i386: Red Hat Linux 9: SRPMS: i386: 6. Verification: MD5 sum Package Name - -------------------------------------------------------------------------- 68c4a788b259ac5d80696344a1635238 7.1/en/os/SRPMS/openssh-3.1p1-9.src.rpm 2cb116a25b5d3f2ae0290c2b02eb822a 7.1/en/os/i386/openssh-3.1p1-9.i386.rpm 8871705678463c84f5bac0d7e314c51d 7.1/en/os/i386/openssh-askpass-3.1p1-9.i386.rpm d40669604c1003d5fa56a0fe8f5f259f 7.1/en/os/i386/openssh-askpass-gnome-3.1p1-9.i386.rpm ad58192a0988ae2ba28303892344dc15 7.1/en/os/i386/openssh-clients-3.1p1-9.i386.rpm 275ab4661dfef3d2331a044723728ba8 7.1/en/os/i386/openssh-server-3.1p1-9.i386.rpm 8a643b9a1c2081510494bcfe81d704da 7.2/en/os/SRPMS/openssh-3.1p1-10.src.rpm 41d575bf0e8740dea7be6f228cd49a06 7.2/en/os/i386/openssh-3.1p1-10.i386.rpm 4b768a29889a977e780f40829767f139 7.2/en/os/i386/openssh-askpass-3.1p1-10.i386.rpm c6ade41287005e1bc3e773d489571b2f 7.2/en/os/i386/openssh-askpass-gnome-3.1p1-10.i386.rpm ac2a157d5527b94629b393709dafee88 7.2/en/os/i386/openssh-clients-3.1p1-10.i386.rpm dfd86218d209c998c1f5877470e08ee3 7.2/en/os/i386/openssh-server-3.1p1-10.i386.rpm 35ed02df36d62ae2ae388bdb1a2fde8b 7.2/en/os/ia64/openssh-3.1p1-10.ia64.rpm 00efc09f44de8e8757ed002b1c8f33d17.2/en/os/ia64/openssh-askpass-3.1p1-10.ia64.rpm 0a08a3bf5bdd95fb718c9f588aeb19a5 7.2/en/os/ia64/openssh-askpass-gnome-3.1p1-10.ia64.rpm ad1d2c29d579622abeb9aaddc3ba2205 7.2/en/os/ia64/openssh-clients-3.1p1-10.ia64.rpm baa9c271eea7d6d3d49fc14d4cc6cd20 7.2/en/os/ia64/openssh-server-3.1p1-10.ia64.rpm 8a643b9a1c2081510494bcfe81d704da 7.3/en/os/SRPMS/openssh-3.1p1-10.src.rpm 41d575bf0e8740dea7be6f228cd49a06 7.3/en/os/i386/openssh-3.1p1-10.i386.rpm 4b768a29889a977e780f40829767f139 7.3/en/os/i386/openssh-askpass-3.1p1-10.i386.rpm c6ade41287005e1bc3e773d489571b2f 7.3/en/os/i386/openssh-askpass-gnome-3.1p1-10.i386.rpm ac2a157d5527b94629b393709dafee88 7.3/en/os/i386/openssh-clients-3.1p1-10.i386.rpm dfd86218d209c998c1f5877470e08ee3 7.3/en/os/i386/openssh-server-3.1p1-10.i386.rpm 9b0e321ba85cb0d0d92aa8d2215b660b 8.0/en/os/SRPMS/openssh-3.4p1-5.src.rpm 98eec1cabf75d33b4dab5cbcc1fa3916 8.0/en/os/i386/openssh-3.4p1-5.i386.rpm 40a5f106abe732b2de667d8eea533bfb 8.0/en/os/i386/openssh-askpass-3.4p1-5.i386.rpm 2d7066401fdffdc33d8432c5a6e15bf2 8.0/en/os/i386/openssh-askpass-gnome-3.4p1-5.i386.rpm 437bf2bd207673ce3ab9632e6c862972 8.0/en/os/i386/openssh-clients-3.4p1-5.i386.rpm b1d6e055c373770fac486b1c32b1110b 8.0/en/os/i386/openssh-server-3.4p1-5.i386.rpm 7b1cf7bfc16af8675fef75f1c82825ca 9/en/os/SRPMS/openssh-3.5p1-9.src.rpm 42127cbc814679cefd1db11265eb2ded 9/en/os/i386/openssh-3.5p1-9.i386.rpm 301a68bc432e7ac55f847edbb30b4741 9/en/os/i386/openssh-askpass-3.5p1-9.i386.rpm baeb84c227233c05d5b6e9e3bc1bdd3d 9/en/os/i386/openssh-askpass-gnome-3.5p1-9.i386.rpm 78188bca46a3ccbba67d1040f42e3c07 9/en/os/i386/openssh-clients-3.5p1-9.i386.rpm 2233bfd17074fd127dac4f47b57e905c 9/en/os/i386/openssh-server-3.5p1-9.i386.rpm These packages are GPG signed by Red Hat for security. Our key is available from https://access.redhat.com/security/team/key You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sumwith the following command: md5sum 7. References: http://marc.theaimsgroup.com/?l=openbsd-misc&m=106371592604940 CVE -CVE-2003-0693 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/en/technologies/all-products Copyright 2003 Red Hat, Inc. . Update OpenSSH packages immediately to fix a critical exploit in buffer handling vulnerabilities on Red Hat Linux systems.. OpenSSH Update, Red Hat Security, Buffer Management Issue. . Severity: Critical. LinuxSecurity.com Team
Sep 16, 2003
•Critical
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!