Stay Secure with the Latest Linux Advisories

security advisorybuffer overflowcritical

SUSE: 2016:0118-1 Critical: OpenSSH Buffer Overflow and Key Exposure

An update that fixes two vulnerabilities is now available. An update that fixes two vulnerabilities is now available. An update that fixes two vulnerabilities is now available.. SUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0118-1 Rating: critical References: #961642 #961645 Cross-References: CVE-2016-0777 CVE-2016-0778 Affected Products: SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12-SP1 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for openssh fixes the following issues: - CVE-2016-0777: A malicious or compromised server could cause the OpenSSH client to expose part or all of the client's private key through the roaming feature (bsc#961642) - CVE-2016-0778: A malicious or compromised server could could trigger a buffer overflow in the OpenSSH client through the roaming feature (bsc#961645) This update disables the undocumented feature supported by the OpenSSH client and a commercial SSH server. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-85=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-85=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-85=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-85=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-SP1(ppc64le s390x x86_64): openssh-6.6p1-33.1 openssh-askpass-gnome-6.6p1-33.1 openssh-askpass-gnome-debuginfo-6.6p1-33.1 openssh-debuginfo-6.6p1-33.1 openssh-debugsource-6.6p1-33.1 openssh-fips-6.6p1-33.1 openssh-helpers-6.6p1-33.1 openssh-helpers-debuginfo-6.6p1-33.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): openssh-6.6p1-33.1 openssh-askpass-gnome-6.6p1-33.1 openssh-askpass-gnome-debuginfo-6.6p1-33.1 openssh-debuginfo-6.6p1-33.1 openssh-debugsource-6.6p1-33.1 openssh-fips-6.6p1-33.1 openssh-helpers-6.6p1-33.1 openssh-helpers-debuginfo-6.6p1-33.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): openssh-6.6p1-33.1 openssh-askpass-gnome-6.6p1-33.1 openssh-askpass-gnome-debuginfo-6.6p1-33.1 openssh-debuginfo-6.6p1-33.1 openssh-debugsource-6.6p1-33.1 openssh-helpers-6.6p1-33.1 openssh-helpers-debuginfo-6.6p1-33.1 - SUSE Linux Enterprise Desktop 12 (x86_64): openssh-6.6p1-33.1 openssh-askpass-gnome-6.6p1-33.1 openssh-askpass-gnome-debuginfo-6.6p1-33.1 openssh-debuginfo-6.6p1-33.1 openssh-debugsource-6.6p1-33.1 openssh-helpers-6.6p1-33.1 openssh-helpers-debuginfo-6.6p1-33.1 References: https://www.suse.com/security/cve/CVE-2016-0777.html https://www.suse.com/security/cve/CVE-2016-0778.html https://bugzilla.suse.com/show_bug.cgi?id=961642 https://bugzilla.suse.com/show_bug.cgi?id=961645 . New patch released for SUSE addressing serious vulnerabilities in OpenSSH, enhancing overall system reliability.. OpenSSH Patch, SUSE Security Update, Critical Vulnerability Fix. . Severity: Critical. LinuxSecurity.com Team

Jan 14, 2016 •Critical SuSE