From: Turbolinux <security@turbolinux.com>
To: tl-security-announce@www1.turbolinux.com
Subject: [TL-Security-Announce] openssh-2.9.p2-6 TLSA2002001
Date: Wed, 23 Jan 2002 13:05:05 -0800
___________________________________________________________________________
Turbolinux Security Announcement
Package: openssh
Vulnerable Packages: Versions 2.5, 2.5.1, 2.5.2, 2.9p2
Date: Wed Jan 23 12:25:13 PST 2002
Affected Turbolinux versions: All Turbolinux versions
6.0.5 and earlier
Turbolinux Advisory ID#: TLSA2002001
Credits: http://www.securityfocus.com/bid/3369
http://www.debian.org/security/2001/dsa-091
___________________________________________________________________________
A security hole was discovered in the package mentioned above.
Please update the package in your installation as soon as possible.
___________________________________________________________________________
1. Problem Summary
If the UseLogin feature is enabled in ssh local users could pass
environment variables to the login process.
2. Impact
A user can gain root privileges.
3. Solution
This has been fixed by not copying the environment if UseLogin is enabled.
Update the following packages from our ftp server
by running the following command:
rpm -Uvh ftp://ftp.turbolinux.com/pub/updates/6.0/security/<rpm>
Where <rpm> are the following:
openssl-0.9.6b-1.i386.rpm
openssl-devel-0.9.6b-1.i386.rpm
openssh-2.9p2-6.i386.rpm
openssh-askpass-2.9p2-6.i386.rpm
openssh-askpass-gnome-2.9p2-6.i386.rpm
openssh-clients-2.9p2-6.i386.rpm
openssh-sever-2.9p2-6.i386.rpm
The source RPM can be downloaded from:
ftp://ftp.turbolinux.com/pub/updates/6.0/SRPMS/openssl-0.9.6b-1.src.rpm
ftp://ftp.turbolinux.com/pub/updates/6.0/SRPMS/openssh-2.9p2-6.src.rpm
**Note: You must rebuild and install the RPM if you choose to download
and install the SRPM. Simply installing the SRPM alone WILL NOT CLOSE
THE SECURITY HOLE.
Please verify the MD5 checksums of the updates before you install:
MD5 sum Package Name
---------------------------------------------------------------------------
7baf5092eda996102994ac1355c2bd91 openssl-0.9.6b-1.i386.rpm
730c61b8e211aa8d6e95fc485b10ecd0 openssl-devel-0.9.6b-1.i386.rpm
faf08731401d84ec0e5cca950f01309c openssh-2.9p2-6.i386.rpm
35a64fc5df7993ccb329575998aa29e3 openssh-askpass-2.9p2-6.i386.rpm
bd5c97d456716d4c7e94bc8e9eee88cd openssh-askpass-gnome-2.9p2-6.i386.rpm
0c512505468fbb9528eafc192aaba411 openssh-clients-2.9p2-6.i386.rpm
d99af7662df237bfba74f11fd484d9ff openssh-sever-2.9p2-6.i386.rpm
61da3275c2885cb67abe51a434de6ef4 openssl-0.9.6b-1.src.rpm
d91df1e8096012463c54565ce5739499 openssh-2.9p2-6.src.rpm
___________________________________________________________________________
These packages are GPG signed by Turbolinux for security. Our key
is available here:
http://www.turbolinux.com/security/tlgpgkey2002-01-09.asc
To verify a package, use the following command:
rpm --checksig name_of_rpm
To examine only the md5sum, use the following command:
rpm --checksig --nogpg name_of_rpm
**Note: Checking GPG keys requires RPM 3.0 or higher.
___________________________________________________________________________
You can find more updates on our ftp server:
ftp://ftp.turbolinux.com/pub/updates/6.0/security/ for TL6.0 Workstation
and Server security updates
ftp://ftp.turbolinux.com/pub/updates/7.0/security/ for TL7.0 Workstation
and Server security updates
Our webpage for security announcements:
http://www.turbolinux.com/security
If you want to report vulnerabilities, please contact:
security@turbolinux.com
___________________________________________________________________________
Subscribe to the Turbolinux Security Mailing lists:
TL-security - A moderated list for discussing security issues
Turbolinux products.
Subscribe at http://www.turbolinux.com/mailman/listinfo/tl-security
TL-security-announce - An announce-only mailing list for security updates
and alerts.
Subscribe at:
http://www.turbolinux.com/mailman/listinfo/tl-security-announce
___________________________________________________________________________