-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2008:098
http://www.mandriva.com/security/
_______________________________________________________________________
Package : openssh
Date : May 6, 2008
Affected: 2007.1, 2008.0, 2008.1
_______________________________________________________________________
Problem Description:
A vulnerability in OpenSSH 4.4 through 4.8 allowed local attackers
to bypass intended security restrictions enabling them to execute
commands other than those specified by the ForceCommand directive,
provided they are able to modify to ~/.ssh/rc (CVE-2008-1657).
The updated packages have been patched to correct this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1657
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2007.1:
08f6f5bdd307e17c510aa5d100f91ef3 2007.1/i586/openssh-4.6p1-1.3mdv2007.1.i586.rpm
235d55d80b04e360e8d7c5fa94633251 2007.1/i586/openssh-askpass-4.6p1-1.3mdv2007.1.i586.rpm
09d544148faf91e07782b663f7010e51 2007.1/i586/openssh-askpass-common-4.6p1-1.3mdv2007.1.i586.rpm
379538dd86330b4577ee785bcd565962 2007.1/i586/openssh-askpass-gnome-4.6p1-1.3mdv2007.1.i586.rpm
e6e85335d7d25e0fd51eaaeedfe8c02a 2007.1/i586/openssh-clients-4.6p1-1.3mdv2007.1.i586.rpm
b9ef64c7c673c831dd06ad2191f9c5d7 2007.1/i586/openssh-server-4.6p1-1.3mdv2007.1.i586.rpm
8ea0e336e89c8f2c5a2cc777354a4705 2007.1/SRPMS/openssh-4.6p1-1.3mdv2007.1.src.rpm
Mandriva Linux 2007.1/X86_64:
3c021dffbaa950e10efeefcc5b286fef 2007.1/x86_64/openssh-4.6p1-1.3mdv2007.1.x86_64.rpm
ad92d84d606f22f49fa95576d46d3870 2007.1/x86_64/openssh-askpass-4.6p1-1.3mdv2007.1.x86_64.rpm
61aacfe978daa0447306778ed77cc5f0 2007.1/x86_64/openssh-askpass-common-4.6p1-1.3mdv2007.1.x86_64.rpm
ad2a37a51549e8d06a0bfc1c71642d46 2007.1/x86_64/openssh-askpass-gnome-4.6p1-1.3mdv2007.1.x86_64.rpm
d21605f50fc092f4e8a003a3a6cebaae 2007.1/x86_64/openssh-clients-4.6p1-1.3mdv2007.1.x86_64.rpm
829c6e69c77c06653859e0106f80dece 2007.1/x86_64/openssh-server-4.6p1-1.3mdv2007.1.x86_64.rpm
8ea0e336e89c8f2c5a2cc777354a4705 2007.1/SRPMS/openssh-4.6p1-1.3mdv2007.1.src.rpm
Mandriva Linux 2008.0:
1eac74e91da446d6f9e894e3135b6f97 2008.0/i586/openssh-4.7p1-2.3mdv2008.0.i586.rpm
32c9074f32ac7dd8fc984840c8acb6d1 2008.0/i586/openssh-askpass-4.7p1-2.3mdv2008.0.i586.rpm
b9bab2a236c21278137259639db8fa8a 2008.0/i586/openssh-askpass-common-4.7p1-2.3mdv2008.0.i586.rpm
393d108b1240c00220ad1b9dc0714b8e 2008.0/i586/openssh-askpass-gnome-4.7p1-2.3mdv2008.0.i586.rpm
c0e15a413edaf5fe6a928f8b6768be89 2008.0/i586/openssh-clients-4.7p1-2.3mdv2008.0.i586.rpm
1842ee4e60d22d98e9dfa3df8c217ad2 2008.0/i586/openssh-server-4.7p1-2.3mdv2008.0.i586.rpm
70c9befdfac13b13e875cf28d1a4b20d 2008.0/SRPMS/openssh-4.7p1-2.3mdv2008.0.src.rpm
Mandriva Linux 2008.0/X86_64:
1f944839aa880524ae6b0397e938ca60 2008.0/x86_64/openssh-4.7p1-2.3mdv2008.0.x86_64.rpm
9110212034c355a7b1aed824f24b0cd2 2008.0/x86_64/openssh-askpass-4.7p1-2.3mdv2008.0.x86_64.rpm
cc1751f3b90e1fe0a2324c32291c6db1 2008.0/x86_64/openssh-askpass-common-4.7p1-2.3mdv2008.0.x86_64.rpm
2b3e84eddd18300eec8678c22f4c6405 2008.0/x86_64/openssh-askpass-gnome-4.7p1-2.3mdv2008.0.x86_64.rpm
bc7ad105ab14f63baeb98443583b311c 2008.0/x86_64/openssh-clients-4.7p1-2.3mdv2008.0.x86_64.rpm
7ca607d434d83e127123e7e8ec6d1c61 2008.0/x86_64/openssh-server-4.7p1-2.3mdv2008.0.x86_64.rpm
70c9befdfac13b13e875cf28d1a4b20d 2008.0/SRPMS/openssh-4.7p1-2.3mdv2008.0.src.rpm
Mandriva Linux 2008.1:
2400784116e037ec9f6864c6e0a84039 2008.1/i586/openssh-4.7p1-9.1mdv2008.1.i586.rpm
461526e375087387d6d46c4413e54a99 2008.1/i586/openssh-askpass-4.7p1-9.1mdv2008.1.i586.rpm
b42eb4cd2e66cad2a3e610458e3d25a9 2008.1/i586/openssh-askpass-common-4.7p1-9.1mdv2008.1.i586.rpm
70ddcfc089436570c498693222248ecb 2008.1/i586/openssh-askpass-gnome-4.7p1-9.1mdv2008.1.i586.rpm
43148a16687a9fe1426e4e1831bbb522 2008.1/i586/openssh-clients-4.7p1-9.1mdv2008.1.i586.rpm
6ef013aabf5d4e46ade484723ca21874 2008.1/i586/openssh-server-4.7p1-9.1mdv2008.1.i586.rpm
4aee9693056b28dc290eddb82d18d9a1 2008.1/SRPMS/openssh-4.7p1-9.1mdv2008.1.src.rpm
Mandriva Linux 2008.1/X86_64:
99f925a96953943b0379971f50c7e809 2008.1/x86_64/openssh-4.7p1-9.1mdv2008.1.x86_64.rpm
a5c1fc99eb774cebacfa86c9c8670cd7 2008.1/x86_64/openssh-askpass-4.7p1-9.1mdv2008.1.x86_64.rpm
d41cea3f2f26c4a0f7669097465c289a 2008.1/x86_64/openssh-askpass-common-4.7p1-9.1mdv2008.1.x86_64.rpm
eadfa5c68e192b032dc401835c409b61 2008.1/x86_64/openssh-askpass-gnome-4.7p1-9.1mdv2008.1.x86_64.rpm
a3e1001bae15500f892724d1dab797ed 2008.1/x86_64/openssh-clients-4.7p1-9.1mdv2008.1.x86_64.rpm
ebb79e86c2428367a967d210ccd197d6 2008.1/x86_64/openssh-server-4.7p1-9.1mdv2008.1.x86_64.rpm
4aee9693056b28dc290eddb82d18d9a1 2008.1/SRPMS/openssh-4.7p1-9.1mdv2008.1.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFIIMfCmqjQ0CJFipgRAsvXAJ43hthPWw77ThUQbEySBoszK7yI8gCg7i1H
O249fnGInw9vUIhIU/qE880=
=Q3QA
-----END PGP SIGNATURE-----
Received on May 07 2008
Intro
