Home / mailings

PDF

[USN-2710-2] OpenSSH regression

Posted on 18 August 2015
Ubuntu Security

==========================
==========================
========================
Ubuntu Security Notice USN-2710-2
August 18, 2015

openssh regression
==========================
==========================
========================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 15.04
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS

Summary:

USN-2710-1 introduced a regression in OpenSSH.

Software Description:
- openssh: secure shell (SSH) for secure access to remote machines

Details:

USN-2710-1 fixed vulnerabilities in OpenSSH. The upstream fix for
CVE-2015-5600 caused a regression resulting in random authentication
failures in non-default configurations. This update fixes the problem.

Original advisory details:

Moritz Jodeit discovered that OpenSSH incorrectly handled usernames when=

using PAM authentication. If an additional vulnerability were discovered=
in
the OpenSSH unprivileged child process, this issue could allow a remote
attacker to perform user impersonation. (CVE number pending)
Moritz Jodeit discovered that OpenSSH incorrectly handled context memor=
y
when using PAM authentication. If an additional vulnerability were
discovered in the OpenSSH unprivileged child process, this issue could
allow a remote attacker to bypass authentication or possibly execute
arbitrary code. (CVE number pending)
Jann Horn discovered that OpenSSH incorrectly handled time windows for
X connections. A remote attacker could use this issue to bypass certain
access restrictions. (CVE-2015-5352)
It was discovered that OpenSSH incorrectly handled keyboard-interactive=

authentication. In a non-default configuration, a remote attacker could
possibly use this issue to perform a brute-force password attack.
(CVE-2015-5600)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.04:
openssh-server 1:6.7p1-5ubuntu1.3

Ubuntu 14.04 LTS:
openssh-server 1:6.6p1-2ubuntu2.3

Ubuntu 12.04 LTS:
openssh-server 1:5.9p1-5ubuntu1.7

In general, a standard system update will make all the necessary changes.=


References:
http://www.ubuntu.com/usn/usn-2710-2
http://www.ubuntu.com/usn/usn-2710-1
https://launchpad.net/bugs/1485719

Package Information:
https://launchpad.net/ubuntu/+source/openssh/1:6.7p1-5ubuntu1.3
https://launchpad.net/ubuntu/+source/openssh/1:6.6p1-2ubuntu2.3
https://launchpad.net/ubuntu/+source/openssh/1:5.9p1-5ubuntu1.7

 

TOP