USN-649-1: OpenSSH vulnerabilities


 
Thread Tools Search this Thread
Special Forums Cybersecurity Security Advisories (RSS) USN-649-1: OpenSSH vulnerabilities
# 1  
Old 10-01-2008
USN-649-1: OpenSSH vulnerabilities

Referenced CVEs:
CVE-2008-1657, CVE-2008-4109


Description:
===========================================================Ubuntu Security Notice USN-649-1 October 01, 2008openssh vulnerabilitiesCVE-2008-1657, CVE-2008-4109===========================================================A security issue affects the following Ubuntu releases:Ubuntu 6.06 LTSUbuntu 7.04Ubuntu 7.10This advisory also applies to the corresponding versions ofKubuntu, Edubuntu, and Xubuntu.The problem can be corrected by upgrading your system to thefollowing package versions:Ubuntu 6.06 LTS: openssh-server 1:4.2p1-7ubuntu3.5Ubuntu 7.04: openssh-server 1:4.3p2-8ubuntu1.5Ubuntu 7.10: openssh-server 1:4.6p1-5ubuntu0.6In general, a standard system upgrade is sufficient to effect thenecessary changes.Details follow:It was discovered that the ForceCommand directive could be bypassed.If a local user created a malicious ~/.ssh/rc file, they could executearbitrary commands as their user id. This only affected Ubuntu 7.10.(CVE-2008-1657)USN-355-1 fixed vulnerabilities in OpenSSH. It was discovered that thefixes for this issue were incomplete. A remote attacker could attemptmultiple logins, filling all available connection slots, leading to adenial of service. This only affected Ubuntu 6.06 and 7.04.(CVE-2008-4109)





More...
Login or Register to Ask a Question

Previous Thread | Next Thread
Login or Register to Ask a Question
Net::OpenSSH::Compat::SSH2(3pm) 			User Contributed Perl Documentation			   Net::OpenSSH::Compat::SSH2(3pm)

NAME
Net::OpenSSH::Compat::SSH2 - Net::OpenSSH adapter for Net::SSH2 API compatibility SYNOPSIS
use Net::OpenSSH::Compat::SSH2 qw(:supplant); use Net::SSH2; my $ssh2 = Net::SSH2->new; $ssh2->connect('host'); $ssh2->auth_publickey("jsmith", "/home/jsmith/.ssh/id_dsa.pub", "/home/jsmith/.ssh/id_dsa"); my $c = $ssh2->channel; $c->exec("ls"); print while <$c>; $c->close; print "exit status: ", $c->exit_status, " "; DESCRIPTION
This module implements Net::SSH2 API on top of Net::OpenSSH. After the module is loaded as... use Net::OpenSSH::Compat::SSH2 qw(:supplant); it will supplant the Net::SSH2 module as if it was installed on the machine and use Net::OpenSSH under the hood to handle SSH operations. Most programs using Net::SSH2 should continue to work without any change. Setting defaults The hash %Net::OpenSSH::Compat::SSH2::DEFAULTS can be used to set default values for Net::OpenSSH and other modules called under the hood and otherwise not accesible through the Net::SSH2 API. The entries currently supported are: connection => [ %opts ] Extra options passed to "Net::OpenSSH::new" constructor. Example: $Net::OpenSSH::Compat::SSH2::DEFAULTS{connection} = [ ssh_path => "/opt/SSH/bin/ssh" ]; channel => [ %opts ] Extra options passed to "Net::OpenSSH::open_ex" method. sftp => [ %opts ] Extra options passed to "Net::SFTP::Foreign::new" constructor. $Net::OpenSSH::Compat::SSH2::DEFAULTS{connection} = [ read_ahead => 128 * 1024, queue_size => 20 ]; BUGS AND SUPPORT
This is a work in progress. Besides that, there are some functionality of Net::SSH2 that can not be emulated with Net::OpenSSH. Fortunatelly, the missing bits are rarely used so probably you may not need them at all. Specifically, the return values from the "$ssh2->method($ATTR)" are not real but faked ones. "auth_list" return value is also faked. Anyway, if your Net::SSH2 script fails, fill a bug report at the CPAN RT bugtracker (https://rt.cpan.org/Ticket/Create.html?Queue=Net-OpenSSH-Compat <https://rt.cpan.org/Ticket/Create.html?Queue=Net-OpenSSH-Compat>) or just send me an e-mail with the details. Include at least: 1 - The full source of the script 2 - A description of what happens in your machine 3 - What you thing it should be happening 4 - What happens when you use the real Net::SSH2 5 - The version and name of your operating system 6 - The version of the OpenSSH ssh client installed on your machine ("ssh -V") 7 - The Perl version ("perl -V") 8 - The versions of the Perl packages Net::OpenSSH, IO::Pty and this Net::OpenSSH::Compat. Git repository The source code repository is at https://github.com/salva/p5-Net-OpenSSH-Compat <https://github.com/salva/p5-Net-OpenSSH-Compat>. My wishlist If you like this module and you're feeling generous, take a look at my Amazon Wish List: <http://amzn.com/w/1WU1P6IR5QZ42> Also consider contributing to the OpenSSH project this module builds upon: <http://www.openssh.org/donations.html>. COPYRIGHT AND LICENSE
Copyright (C) 2011 by Salvador Fandin~o (sfandino@yahoo.com) This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.10.0 or, at your option, any later version of Perl 5 you may have available. perl v5.14.2 2011-09-28 Net::OpenSSH::Compat::SSH2(3pm)