[Full-Disclosure] GLSA: openssh (200305-01)

From: Daniel Ahlberg (aliz_at_gentoo.org)
Date: 05/02/03

  • Next message: Bernhard Trabert: "[Full-Disclosure] Re: eBay Security Contact" 
    To: full-disclosure@lists.netsys.com
Date: Fri, 2 May 2003 12:03:13 +0200

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    - - - ---------------------------------------------------------------------
    GENTOO LINUX SECURITY ANNOUNCEMENT 200305-01
    - - - ---------------------------------------------------------------------

              PACKAGE : openssh
              SUMMARY : timing attack leads to information disclosure
                 DATE : 2003-05-02 10:03 UTC
              EXPLOIT : remote
    VERSIONS AFFECTED : <openssh-3.6.1_p2
        FIXED VERSION : >=openssh-3.6.1_p2
                  CVE : CAN-2003-0190

    - - - ---------------------------------------------------------------------

    Mediaservice.net has discovered a bug in OpenSSH that allows attackers
    to identify valid users on vulnerable systems.

    Read the full advisory at
    http://lab.mediaservice.net/advisory/2003-01-openssh.txt

    SOLUTION

    It is recommended that all Gentoo Linux users who are running
    net-misc/openssh upgrade to openssh-3.6.1_p2 as follows:

    emerge sync
    emerge openssh
    emerge clean

    - - - ---------------------------------------------------------------------
    aliz@gentoo.org - GnuPG key is available at http://cvs.gentoo.org/~aliz
    - - - ---------------------------------------------------------------------
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.1 (GNU/Linux)

    iD8DBQE+skJefT7nyhUpoZMRAt74AKCjytn9UHR9YILDL0eCwV18YaoP/gCgp1L/
    H9P9IVPXLlIHsJWW9XXL***=
    =Yz9f
    -----END PGP SIGNATURE-----
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Bernhard Trabert: "[Full-Disclosure] Re: eBay Security Contact"
    • Quantcast