MDKSA-2006:179

Package name
openssh
Date
2006-10-03
Advisory ID
MDKSA-2006:179
Affected versions
CS4.0 x86_64 , MNF2.0 i586 , 2006.0 i586 , 2007.0 x86_64 , 2007.0 i586 , CS3.0 x86_64 , CS4.0 i586 , CS3.0 i586 , 2006.0 x86_64

Problem description

Tavis Ormandy of the Google Security Team discovered a Denial of
Service vulnerability in the SSH protocol version 1 CRC compensation
attack detector. This could allow a remote unauthenticated attacker to
trigger excessive CPU utilization by sending a specially crafted SSH
message, which would then deny ssh services to other users or processes
(CVE-2006-4924, CVE-2006-4925). Please note that Mandriva ships with
only SSH protocol version 2 enabled by default.

Next, an unsafe signal handler was found by Mark Dowd. This signal
handler was vulnerable to a race condition that could be exploited to
perform a pre-authentication DoS, and theoretically a
pre-authentication remote code execution in the case where some
authentication methods like GSSAPI are enabled (CVE-2006-5051).

Updated packages have been patched to correct this issue.

Updated packages

CS4.0 x86_64

 5bdd94f5242c68fe0b490c13cbd08ea0  corporate/4.0/x86_64/openssh-4.3p1-0.3.20060mlcs4.x86_64.rpm
 48874aea14500ca90da22dcdfab029f8  corporate/4.0/x86_64/openssh-askpass-4.3p1-0.3.20060mlcs4.x86_64.rpm
 4f7a3fc780511ead79932bbdf5e64b61  corporate/4.0/x86_64/openssh-askpass-gnome-4.3p1-0.3.20060mlcs4.x86_64.rpm
 d99aa2e584d3e58cf40e49c99d9ce3a6  corporate/4.0/x86_64/openssh-clients-4.3p1-0.3.20060mlcs4.x86_64.rpm
 6a622455fc895b7b30d049d799207f19  corporate/4.0/x86_64/openssh-server-4.3p1-0.3.20060mlcs4.x86_64.rpm 
 988d0f895a34d6a71e69f7ec12bd45f0  corporate/4.0/SRPMS/openssh-4.3p1-0.3.20060mlcs4.src.rpm

MNF2.0 i586

 6da5f9bf7f28e8017133a4f5fa72651f  mnf/2.0/i586/openssh-4.3p1-0.2.M20mdk.i586.rpm
 3b5fce9c7d8a67a179bb40c3c537f160  mnf/2.0/i586/openssh-askpass-4.3p1-0.2.M20mdk.i586.rpm
 7ff70b823d0fa18677447a90bb3ea503  mnf/2.0/i586/openssh-askpass-gnome-4.3p1-0.2.M20mdk.i586.rpm
 434e7b3885a37ce4d72ed7f2fd3d9342  mnf/2.0/i586/openssh-clients-4.3p1-0.2.M20mdk.i586.rpm
 1772c26f342a5d8b00c3894cdf6ad514  mnf/2.0/i586/openssh-server-4.3p1-0.2.M20mdk.i586.rpm 
 2d96693d80c25155b97272596da9aabe  mnf/2.0/SRPMS/openssh-4.3p1-0.2.M20mdk.src.rpm

2006.0 i586

 1280b30b3520a9ca5c2e6a716a770a0c  2006.0/i586/openssh-4.3p1-0.3.20060mdk.i586.rpm
 007b28a957c4537d6ed196d2b2367c1e  2006.0/i586/openssh-askpass-4.3p1-0.3.20060mdk.i586.rpm
 280b2c0b27ef2387110d363493be892f  2006.0/i586/openssh-askpass-gnome-4.3p1-0.3.20060mdk.i586.rpm
 3a41abc407c20928f672223c67d06c36  2006.0/i586/openssh-clients-4.3p1-0.3.20060mdk.i586.rpm
 063589a511985d4127e03c349fa23330  2006.0/i586/openssh-server-4.3p1-0.3.20060mdk.i586.rpm 
 6f11187f048ef296607c54c1c92e7c24  2006.0/SRPMS/openssh-4.3p1-0.3.20060mdk.src.rpm

2007.0 x86_64

 a1ed25a9f53038434574b3ce921eac1a  2007.0/x86_64/openssh-4.3p2-12.1mdv2007.0.x86_64.rpm
 d9acf43a28f105d80fcd7a12535efdda  2007.0/x86_64/openssh-askpass-4.3p2-12.1mdv2007.0.x86_64.rpm
 ed6488abb9c621dab762307136493969  2007.0/x86_64/openssh-askpass-common-4.3p2-12.1mdv2007.0.x86_64.rpm
 ef48a28c45ec44dc1f20eb0ee26f4877  2007.0/x86_64/openssh-askpass-gnome-4.3p2-12.1mdv2007.0.x86_64.rpm
 80c7ee2ccb6ac35fe1b893cb58b092cd  2007.0/x86_64/openssh-clients-4.3p2-12.1mdv2007.0.x86_64.rpm
 217eb2fbf7574aa34a592e54d527f8dd  2007.0/x86_64/openssh-server-4.3p2-12.1mdv2007.0.x86_64.rpm 
 c9ccf40372c7c2b0eca968aec9f9385d  2007.0/SRPMS/openssh-4.3p2-12.1mdv2007.0.src.rpm

2007.0 i586

 9687bdb4f2865c2765da0f01efda87ef  2007.0/i586/openssh-4.3p2-12.1mdv2007.0.i586.rpm
 40f80b906c0e9ec5d2d6622ce7efc3fd  2007.0/i586/openssh-askpass-4.3p2-12.1mdv2007.0.i586.rpm
 b50bae14a353fdd3ca632096467a51cd  2007.0/i586/openssh-askpass-common-4.3p2-12.1mdv2007.0.i586.rpm
 0d393f5af4f97c0ca2073c3f11628a40  2007.0/i586/openssh-askpass-gnome-4.3p2-12.1mdv2007.0.i586.rpm
 084d0fa10aa7daa1aaea59cb2efc9494  2007.0/i586/openssh-clients-4.3p2-12.1mdv2007.0.i586.rpm
 07f0a46845c178b78549c0734074407f  2007.0/i586/openssh-server-4.3p2-12.1mdv2007.0.i586.rpm 
 c9ccf40372c7c2b0eca968aec9f9385d  2007.0/SRPMS/openssh-4.3p2-12.1mdv2007.0.src.rpm

CS3.0 x86_64

 dab1069ffd0d206b230872ce11d6ef32  corporate/3.0/x86_64/openssh-4.3p1-0.2.C30mdk.x86_64.rpm
 940a582fce6836589755ceea2d494421  corporate/3.0/x86_64/openssh-askpass-4.3p1-0.2.C30mdk.x86_64.rpm
 ee2543c6210ce8294e586305aa950c0e  corporate/3.0/x86_64/openssh-askpass-gnome-4.3p1-0.2.C30mdk.x86_64.rpm
 236f5b3229aebf958a7726f861f5c279  corporate/3.0/x86_64/openssh-clients-4.3p1-0.2.C30mdk.x86_64.rpm
 245fa68997db318e68b27c1d47a19219  corporate/3.0/x86_64/openssh-server-4.3p1-0.2.C30mdk.x86_64.rpm 
 b6c94995c4c1408a1d72b6fb1956e7c1  corporate/3.0/SRPMS/openssh-4.3p1-0.2.C30mdk.src.rpm

CS4.0 i586

 cd934818457b0e688c5e49e16e022e03  corporate/4.0/i586/openssh-4.3p1-0.3.20060mlcs4.i586.rpm
 3d14fc47de98f81e803755f80df948c1  corporate/4.0/i586/openssh-askpass-4.3p1-0.3.20060mlcs4.i586.rpm
 03f2d3a6089b5a2d5abcf3ceffeecdc1  corporate/4.0/i586/openssh-askpass-gnome-4.3p1-0.3.20060mlcs4.i586.rpm
 37a2a56723f5dc119acce62df2759749  corporate/4.0/i586/openssh-clients-4.3p1-0.3.20060mlcs4.i586.rpm
 331331d9843f490c6e98c28d54b42ca9  corporate/4.0/i586/openssh-server-4.3p1-0.3.20060mlcs4.i586.rpm 
 988d0f895a34d6a71e69f7ec12bd45f0  corporate/4.0/SRPMS/openssh-4.3p1-0.3.20060mlcs4.src.rpm

CS3.0 i586

 08ee3d3de53563481a748d8b4d9f5e5b  corporate/3.0/i586/openssh-4.3p1-0.2.C30mdk.i586.rpm
 bb472724a2e1afce4b2d526f75d65d3e  corporate/3.0/i586/openssh-askpass-4.3p1-0.2.C30mdk.i586.rpm
 cdcf5e37768032e2c6599d219493db0c  corporate/3.0/i586/openssh-askpass-gnome-4.3p1-0.2.C30mdk.i586.rpm
 1909a018d6883df234a2bb41072a839b  corporate/3.0/i586/openssh-clients-4.3p1-0.2.C30mdk.i586.rpm
 fc516bf57f9faf0168fef9638f1f7546  corporate/3.0/i586/openssh-server-4.3p1-0.2.C30mdk.i586.rpm 
 b6c94995c4c1408a1d72b6fb1956e7c1  corporate/3.0/SRPMS/openssh-4.3p1-0.2.C30mdk.src.rpm

2006.0 x86_64

 68bc6ad235e0534bc57e180b90c33bdb  2006.0/x86_64/openssh-4.3p1-0.3.20060mdk.x86_64.rpm
 d0668a2d76eb927afcaa4897fc509f91  2006.0/x86_64/openssh-askpass-4.3p1-0.3.20060mdk.x86_64.rpm
 502b3088f7f55d3de57b2278b5452a5a  2006.0/x86_64/openssh-askpass-gnome-4.3p1-0.3.20060mdk.x86_64.rpm
 2551d84521716a9b6702a98b9d121b9d  2006.0/x86_64/openssh-clients-4.3p1-0.3.20060mdk.x86_64.rpm
 c8627d7e04e87c1e5bed7d0b744b2ad2  2006.0/x86_64/openssh-server-4.3p1-0.3.20060mdk.x86_64.rpm 
 6f11187f048ef296607c54c1c92e7c24  2006.0/SRPMS/openssh-4.3p1-0.3.20060mdk.src.rpm

References