----------------------------------------------------------------------------
Debian Security Advisory DSA 086-1 security@debian.org
Debian -- Security Information Michael Stone
November 13, 2001
----------------------------------------------------------------------------
Package: ssh-nonfree, ssh-socks
Vulnerability: remote root exploit
Debian-specific: no
We have received reports that the "SSH CRC-32 compensation attack
detector vulnerability" is being actively exploited. This is the same
integer type error previously corrected for OpenSSH in DSA-027-1.
OpenSSH (the Debian ssh package) was fixed at that time, but
ssh-nonfree and ssh-socks were not.
Though packages in the non-free section of the archive are not
officially supported by the Debian project, we are taking the unusal
step of releasing updated ssh-nonfree/ssh-socks packages for those
users who have not yet migrated to OpenSSH. However, we do recommend
that our users migrate to the regularly supported, DFSG-free "ssh"
package as soon as possible. ssh 1.2.3-9.3 is the OpenSSH package
available in Debian 2.2r4.
The fixed ssh-nonfree/ssh-socks packages are available in version
1.2.27-6.2 for use with Debian 2.2 (potato) and version 1.2.27-8 for
use with the Debian unstable/testing distribution. Note that the new
ssh-nonfree/ssh-socks packages remove the setuid bit from the ssh
binary, disabling rhosts-rsa authentication. If you need this
functionality, run
chmod u+s /usr/bin/ssh1
after installing the new package.
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 2.2 alias potato
------------------------------------
Source archives:
MD5 checksum: 92161c3468189f17eb17421fd2e91f1e
MD5 checksum: 8ba9a4c2d4059b973e6c46bb6ab88958
MD5 checksum: c22bc000bee0f7d6f4845eab72a81395
Alpha architecture:
MD5 checksum: 90996c54a25e41d743826648d4160f85
MD5 checksum: bd7a26a286ee8f21e17c943cacb085cc
MD5 checksum: 4c979615edf37d2b980f1d5421f32933
ARM architecture:
Not yet available
Intel ia32 architecture:
MD5 checksum: e43c6b7ad3a6cf71d07f528ad9adb34c
MD5 checksum: e4f6db9acb54b9e3dc75315a66207840
MD5 checksum: 0eab3e6250c3aa4130ec5a2f719531e6
Motorola M680x0 architecture:
MD5 checksum: 903221f1d6b2770aacafe5ec059199bc
MD5 checksum: a491728bdd38a38a0ed9257eb7d8f610
MD5 checksum: 5c8b6771e7c287ba4794f41db771d879
PowerPC architecture:
MD5 checksum: c0366ff3cb037054da92b597d3c48aee
MD5 checksum: 64eb49a847c7e2c16463375948fb1903
MD5 checksum: 2b530b0590aa372c8c77cc8e80ed01e2
Sun Sparc architecture:
MD5 checksum: 1a1844a143bcd2daae80a70005c74084
MD5 checksum: bfcc81152d02d6bc1f5a93018fe56835
MD5 checksum: 3d69332e3c134251439b64f4e379cb68
For not yet released architectures please refer to the appropriate
directory .
----------------------------------------------------------------------------
For apt-get: deb Debian -- Security Information stable/updates main non-free
For dpkg-ftp:
dists/stable/updates/main
dists/stable/updates/non-free
Mailing list: debian-security-announce@lists.debian.org