Date: Fri, 8 Mar 2002 23:05:22 -0800 (PST) From: Bzdik BSD <bzdik@yahoo.com> To: david raistrick <draistrick@gta.com>, stable@freebsd.org Subject: Re: openssh 3.1, more problems? Message-ID: <20020309070522.66025.qmail@web13607.mail.yahoo.com> In-Reply-To: <20020309065423.61758.qmail@web13601.mail.yahoo.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--- Bzdik BSD <bzdik@yahoo.com> wrote: btw, Debians is not patched > yet > in spite of announcements. Oops, my bad: From: Michael Stone <mstone@pandora.debian.org> Subject: [SECURITY] [DSA 119-1] ssh channel bug Date: 08 Mar 2002 21:35:16 +0100 Package: openssh Vulnerability: local root exploit, remote client exploit Debian-specific: no Joost Pol <joost@pine.nl> reports that OpenSSH versions 2.0 through 3.0.2 have an off-by-one bug in the channel allocation code. This vulnerability can be exploited by authenticated users to gain root privilege or by a malicious server exploiting a client with this bug. Since Debian 2.2 (potato) shipped with OpenSSH (the "ssh" package) version 1.2.3, it is not vulnerable to this exploit. No fix is required for Debian 2.2 (potato). The Debian unstable and testing archives do include a more recent OpenSSH (ssh) package. If you are running these pre-release distributions you should ensure that you are running version 3.0.2p1-8, a patched version which was added to the unstable archive today, or a later version. __________________________________________________ Do You Yahoo!? Try FREE Yahoo! Mail - the world's greatest free email! http://mail.yahoo.com/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020309070522.66025.qmail>