[Please upgrade OpenSSH on all platforms. This is in addition to the
advisory released a few days ago -- Raju]
This is an RFC 1153 digest.
(1 message)
----------------------------------------------------------------------
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Return-Path: <[EMAIL PROTECTED]>
Received: from localhost (localhost [127.0.0.1])
by mail.linux-delhi.org (8.12.8/8.12.8) with ESMTP id h8LKF9Br007901
for <[EMAIL PROTECTED]>; Mon, 22 Sep 2003 01:45:10 +0530
Received: from linux-delhi.org [203.200.89.84]
by localhost with POP3 (fetchmail-5.9.0)
for [EMAIL PROTECTED] (single-drop); Mon, 22 Sep 2003 01:45:10 +0530 (IST)
Received: from netsys.com (NETSYS.COM [199.201.233.10])
by ns3.biznetindia.com (8.12.8/8.12.8) with ESMTP id h8LK7Vwq020278
for <[EMAIL PROTECTED]>; Mon, 22 Sep 2003 01:37:33 +0530
Received: from NETSYS.COM (localhost [127.0.0.1])
by netsys.com (8.11.6p2/8.11.6) with ESMTP id h8LJ8Tn06047;
Sun, 21 Sep 2003 15:08:30 -0400 (EDT)
Received: from murphy.debian.org (murphy.debian.org [146.82.138.6])
by netsys.com (8.11.6p2/8.11.6) with ESMTP id h8LJ5ML05470
for <[EMAIL PROTECTED]>; Sun, 21 Sep 2003 15:05:22 -0400 (EDT)
Received: by murphy.debian.org (Postfix, from userid 38)
id 95A441F85F; Sun, 21 Sep 2003 14:05:21 -0500 (CDT)
Old-Return-Path: <[EMAIL PROTECTED]>
Received: from mx1.wiggy.net (home.wiggy.net [213.84.101.140])
by murphy.debian.org (Postfix) with ESMTP id 8F7DB1F55F
for <[EMAIL PROTECTED]>; Sun, 21 Sep 2003 14:05:08 -0500 (CDT)
Received: from tornado.wiggy.net ([2001:888:101d:0:290:27ff:fe2d:968c]:34795
helo=tornado.home.wiggy.net)
by mx1.wiggy.net with esmtp (Exim 4.20)
id 1A19W6-0000rz-UU
for [EMAIL PROTECTED]; Sun, 21 Sep 2003 21:05:06 +0200
Received: from wichert by tornado.home.wiggy.net with local (Exim 4.22)
id 1A19W5-00024l-V4
for [EMAIL PROTECTED]; Sun, 21 Sep 2003 21:05:05 +0200
Old-From: Wichert Akkerman <[EMAIL PROTECTED]>
Old-To: [EMAIL PROTECTED]
Message-ID: <[EMAIL PROTECTED]>
User-Agent: Mutt/1.5.4i
X-Debian: PGP check passed for security officers
Priority: urgent
Precedence: list
Reply-To: [EMAIL PROTECTED]
Mail-Followup-To: [EMAIL PROTECTED]
Errors-To: [EMAIL PROTECTED]
X-BeenThere: [EMAIL PROTECTED]
X-Mailman-Version: 2.0.12
List-Unsubscribe: <http://lists.netsys.com/mailman/listinfo/full-disclosure>,
<mailto:[EMAIL PROTECTED]>
List-Id: Discussion of security issues <full-disclosure.lists.netsys.com>
List-Post: <mailto:[EMAIL PROTECTED]>
List-Help: <mailto:[EMAIL PROTECTED]>
List-Subscribe: <http://lists.netsys.com/mailman/listinfo/full-disclosure>,
<mailto:[EMAIL PROTECTED]>
List-Archive: <http://lists.netsys.com/pipermail/full-disclosure/>
X-Spam-Status: No, hits=3.0 required=9.5
tests=NO_REAL_NAME,PGP_SIGNATURE,RCVD_IN_OSIRUSOFT_COM,
SPAM_PHRASE_00_01,USER_AGENT,USER_AGENT_MUTT,
X_OSIRU_OPEN_RELAY
version=2.43
X-Spam-Level: ***
Resent-Message-ID: <[EMAIL PROTECTED]>
Resent-Date: Sun, 21 Sep 2003 14:05:21 -0500 (CDT)
Resent-From: [EMAIL PROTECTED] (SmartList)
From: [EMAIL PROTECTED]
Sender: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: [Full-Disclosure] [SECURITY] [DSA-382-3] OpenSSH buffer management fix
Date: Sun, 21 Sep 2003 21:05:05 +0200
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
Debian Security Advisory DSA-382-3 [EMAIL PROTECTED]
http://www.debian.org/security/ Wichert Akkerman
September 21, 2003
- ------------------------------------------------------------------------
Package : ssh
Vulnerability : buffer handling
Problem type : possible remote
Debian-specific: no
CVE references : CAN-2003-0693 CAN-2003-0695 CAN-2003-0682
This advisory is an addition to the earlier DSA-382-1 and DSA-382-3
advisories: Solar Designer found four more bugs in OpenSSH that may be
exploitable.
For the Debian stable distribution these bugs have been fixed in version
1:3.4p1-1.woody.3 .
Upgrade Instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.0 alias woody
- --------------------------------
Source archives:
http://security.debian.org/pool/updates/main/o/openssh/openssh_3.4p1.orig.tar.gz
Size/MD5 checksum: 837668 459c1d0262e939d6432f193c7a4ba8a8
http://security.debian.org/pool/updates/main/o/openssh/openssh_3.4p1-1.woody.3.diff.gz
Size/MD5 checksum: 36523 b264717da79efedfbaaecfede3ec5934
http://security.debian.org/pool/updates/main/o/openssh/openssh_3.4p1-1.woody.3.dsc
Size/MD5 checksum: 1350 bf5970e940e1d5bf7345a1d9e778d7f4
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_3.4p1-1.woody.3_alpha.deb
Size/MD5 checksum: 35900 634340333420155ddaf6f70fab3fbd59
http://security.debian.org/pool/updates/main/o/openssh/ssh_3.4p1-1.woody.3_alpha.deb
Size/MD5 checksum: 850196 c9e82af3e9f16941c64d0ae478e1f184
arm architecture (ARM)
http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_3.4p1-1.woody.3_arm.deb
Size/MD5 checksum: 35132 b7c3431b949c24cf1c040be28e06fbbf
http://security.debian.org/pool/updates/main/o/openssh/ssh_3.4p1-1.woody.3_arm.deb
Size/MD5 checksum: 658324 5ac2853c07e93bc498aadcc63565bb82
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/o/openssh/ssh_3.4p1-1.woody.3_hppa.deb
Size/MD5 checksum: 755910 14d426db61713617a1e914bd1c675b07
http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_3.4p1-1.woody.3_hppa.deb
Size/MD5 checksum: 35494 714c4e74169c5985ad745f8928d1e831
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_3.4p1-1.woody.3_i386.deb
Size/MD5 checksum: 35414 ab621997a28bc30c928c2d317ae0c3a9
http://security.debian.org/pool/updates/main/o/openssh/ssh_3.4p1-1.woody.3_i386.deb
Size/MD5 checksum: 642624 a4293645b075984afa600f8094395c2d
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/o/openssh/ssh_3.4p1-1.woody.3_ia64.deb
Size/MD5 checksum: 1002720 ac989f421d1de08ce6487060ce231968
http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_3.4p1-1.woody.3_ia64.deb
Size/MD5 checksum: 36906 45b3a0b3f0564cc6688fab9bc2bceee1
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/o/openssh/ssh_3.4p1-1.woody.3_mipsel.deb
Size/MD5 checksum: 727514 4b667b3d8306af3eb8073e66932c853d
http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_3.4p1-1.woody.3_mipsel.deb
Size/MD5 checksum: 35384 2395ff7a07f5d4e255844d0f608a8161
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/o/openssh/ssh_3.4p1-1.woody.3_powerpc.deb
Size/MD5 checksum: 681524 f8f9c03826fce1dccc16c7d47b93a376
http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_3.4p1-1.woody.3_powerpc.deb
Size/MD5 checksum: 35150 b6a0d8c9edf371d118dd32d503102c6c
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/o/openssh/ssh_3.4p1-1.woody.3_s390.deb
Size/MD5 checksum: 718140 97e5e2e22860eb74d336e2938286d7a7
http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_3.4p1-1.woody.3_s390.deb
Size/MD5 checksum: 35786 97f0c72c5d72b61b5fe9c0c2a1d278be
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/o/openssh/ssh_3.4p1-1.woody.3_sparc.deb
Size/MD5 checksum: 686130 d44dec2bc9161419f71f769fff78f95b
http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_3.4p1-1.woody.3_sparc.deb
Size/MD5 checksum: 35202 1b2eb82ad15a4209237a61000dc63c3c
- --
- ----------------------------------------------------------------------------
Debian Security team <[EMAIL PROTECTED]>
http://www.debian.org/security/
Mailing-List: [EMAIL PROTECTED]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
iD8DBQE/bfZaPLiSUC+jvC0RAm/eAJoCBZEgxQNjwmUPF/X5nDmzSwdYrwCfQAjQ
9EzuhfWxLhqW/yZ7Vd1fcjc=
=DXMK
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
------------------------------
End of this Digest
******************
--
Raj Mathur [EMAIL PROTECTED] http://kandalaya.org/
GPG: 78D4 FC67 367F 40E2 0DD5 0FEF C968 D0EF CC68 D17F
It is the mind that moves
-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
linux-india-help mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/linux-india-help
