Stay Secure with the Latest Linux Advisories

security advisoryopensshubuntu

Ubuntu 2164-1 OpenSSH SSHFP DNS Bypass - Critical Threat

A malicious server could bypass OpenSSH SSHFP DNS record checking.. =========================================================================Ubuntu Security Notice USN-2164-1 April 07, 2014 openssh vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 13.10 - Ubuntu 12.10 - Ubuntu 12.04 LTS Summary: A malicious server could bypass OpenSSH SSHFP DNS record checking. Software Description: - openssh: secure shell (SSH) for secure access to remote machines Details: Matthew Vernon discovered that OpenSSH did not correctly check SSHFP DNS records if a server presented an unacceptable host certificate. A malicious server could use this issue to disable SSHFP checking. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 13.10: openssh-client 1:6.2p2-6ubuntu0.3 Ubuntu 12.10: openssh-client 1:6.0p1-3ubuntu1.2 Ubuntu 12.04 LTS: openssh-client 1:5.9p1-5ubuntu1.3 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-2164-1 CVE-2014-2653 Package Information: https://launchpad.net/ubuntu/+source/openssh/1:6.2p2-6ubuntu0.3 https://launchpad.net/ubuntu/+source/openssh/1:6.0p1-3ubuntu1.2 https://launchpad.net/ubuntu/+source/openssh/1:5.9p1-5ubuntu1.3 . Threatening servers may circumvent OpenSSH SSHFP DNS validation on Ubuntu. Upgrade OpenSSH to enhance your system's security.. OpenSSH Vulnerabilities, Ubuntu Security Updates, SSHFP DNS Issues. . Severity: Critical. LinuxSecurity.com Team

Apr 07, 2014 •Critical Ubuntu