USN-566-1: OpenSSH vulnerability


 
Thread Tools Search this Thread
Special Forums Cybersecurity Security Advisories (RSS) USN-566-1: OpenSSH vulnerability
# 1  
Old 01-09-2008
USN-566-1: OpenSSH vulnerability

Referenced CVEs:
CVE-2007-4752


Description:
=========================================================== Ubuntu Security Notice USN-566-1 January 09, 2008 openssh vulnerability CVE-2007-4752 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: openssh-client 1:4.2p1-7ubuntu3.2 Ubuntu 6.10: openssh-client 1:4.3p2-5ubuntu1.1 Ubuntu 7.04: openssh-client 1:4.3p2-8ubuntu1.1 Ubuntu 7.10: openssh-client 1:4.6p1-5ubuntu0.1 In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: Jan Pechanec discovered that ssh would forward trusted X11 cookies when untrusted cookie generation failed. This could lead to unintended privileges being forwarded to a remote host.





More...
Login or Register to Ask a Question

Previous Thread | Next Thread

1 More Discussions You Might Find Interesting

1. Red Hat

Vulnerability with ssh in OpenSSH in an RHEL installation

There was a security analysis run on one server which has RHEL 5.8 installed and it is showing security vulnerabilities with respect to ssh in OpenSSH with reference no CVE-2007-4752. The vulnerability solution in the security report is showing solution as below: 1) Download and apply the... (3 Replies)
Discussion started by: RHCE
3 Replies
Login or Register to Ask a Question
Net::OpenSSH::Compat::SSH2(3pm) 			User Contributed Perl Documentation			   Net::OpenSSH::Compat::SSH2(3pm)

NAME
Net::OpenSSH::Compat::SSH2 - Net::OpenSSH adapter for Net::SSH2 API compatibility SYNOPSIS
use Net::OpenSSH::Compat::SSH2 qw(:supplant); use Net::SSH2; my $ssh2 = Net::SSH2->new; $ssh2->connect('host'); $ssh2->auth_publickey("jsmith", "/home/jsmith/.ssh/id_dsa.pub", "/home/jsmith/.ssh/id_dsa"); my $c = $ssh2->channel; $c->exec("ls"); print while <$c>; $c->close; print "exit status: ", $c->exit_status, " "; DESCRIPTION
This module implements Net::SSH2 API on top of Net::OpenSSH. After the module is loaded as... use Net::OpenSSH::Compat::SSH2 qw(:supplant); it will supplant the Net::SSH2 module as if it was installed on the machine and use Net::OpenSSH under the hood to handle SSH operations. Most programs using Net::SSH2 should continue to work without any change. Setting defaults The hash %Net::OpenSSH::Compat::SSH2::DEFAULTS can be used to set default values for Net::OpenSSH and other modules called under the hood and otherwise not accesible through the Net::SSH2 API. The entries currently supported are: connection => [ %opts ] Extra options passed to "Net::OpenSSH::new" constructor. Example: $Net::OpenSSH::Compat::SSH2::DEFAULTS{connection} = [ ssh_path => "/opt/SSH/bin/ssh" ]; channel => [ %opts ] Extra options passed to "Net::OpenSSH::open_ex" method. sftp => [ %opts ] Extra options passed to "Net::SFTP::Foreign::new" constructor. $Net::OpenSSH::Compat::SSH2::DEFAULTS{connection} = [ read_ahead => 128 * 1024, queue_size => 20 ]; BUGS AND SUPPORT
This is a work in progress. Besides that, there are some functionality of Net::SSH2 that can not be emulated with Net::OpenSSH. Fortunatelly, the missing bits are rarely used so probably you may not need them at all. Specifically, the return values from the "$ssh2->method($ATTR)" are not real but faked ones. "auth_list" return value is also faked. Anyway, if your Net::SSH2 script fails, fill a bug report at the CPAN RT bugtracker (https://rt.cpan.org/Ticket/Create.html?Queue=Net-OpenSSH-Compat <https://rt.cpan.org/Ticket/Create.html?Queue=Net-OpenSSH-Compat>) or just send me an e-mail with the details. Include at least: 1 - The full source of the script 2 - A description of what happens in your machine 3 - What you thing it should be happening 4 - What happens when you use the real Net::SSH2 5 - The version and name of your operating system 6 - The version of the OpenSSH ssh client installed on your machine ("ssh -V") 7 - The Perl version ("perl -V") 8 - The versions of the Perl packages Net::OpenSSH, IO::Pty and this Net::OpenSSH::Compat. Git repository The source code repository is at https://github.com/salva/p5-Net-OpenSSH-Compat <https://github.com/salva/p5-Net-OpenSSH-Compat>. My wishlist If you like this module and you're feeling generous, take a look at my Amazon Wish List: <http://amzn.com/w/1WU1P6IR5QZ42> Also consider contributing to the OpenSSH project this module builds upon: <http://www.openssh.org/donations.html>. COPYRIGHT AND LICENSE
Copyright (C) 2011 by Salvador Fandin~o (sfandino@yahoo.com) This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.10.0 or, at your option, any later version of Perl 5 you may have available. perl v5.14.2 2011-09-28 Net::OpenSSH::Compat::SSH2(3pm)