|
|
>> Fedora Security Update Fixes OpenSSH Security Bypass Issues
|
Title : Fedora Security Update Fixes OpenSSH Security Bypass Issues
VUPEN ID : VUPEN/ADV-2005-1678
CVE ID : CVE-2005-2798
CWE ID : CWE-
Rated as : Low Risk 
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2005-09-08
|
Fedora has released updated packages to correct two vulnerabilities identified in OpenSSH. The first issue is due to an error introduced in OpenSSH 4.0, which could cause "GatewayPorts" to be incorrectly activated for dynamic port forwarding when no listen address is explicitly specified. The second issue occurs when a user has GSSAPI authentication configured and "GSSAPIDelegateCredentials" is enabled, which could cause Kerberos credentials to be exposed to remote hosts. For additional information, see : VUPEN/ADV-2005-1624
Affected Products
Fedora Core 3
Solution
Upgrade the affected package :
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/
c42c4bf11075a5bc6787427f6f1bbdb7 SRPMS/openssh-3.9p1-8.0.3.src.rpm
65e54cc979b888208a1783018fa2141f x86_64/openssh-3.9p1-8.0.3.x86_64.rpm
aa95f00bd8aee18f1d7709a655dd2900 x86_64/openssh-clients-3.9p1-8.0.3.x86_64.rpm
4c0fdd9c8c8239b47500344fe2a36eae x86_64/openssh-server-3.9p1-8.0.3.x86_64.rpm
c136972b79ba963b8982e90d941a6d25 x86_64/openssh-askpass-3.9p1-8.0.3.x86_64.rpm
6cbf80015a4189468f81e0e58847fe75 x86_64/openssh-askpass-gnome-3.9p1-8.0.3.x86_64.rpm
0fee7f443f1fe6c9e481ac5fb848d83d x86_64/debug/openssh-debuginfo-3.9p1-8.0.3.x86_64.rpm
b2be46aac023e5a2acb035abe299ff51 i386/openssh-3.9p1-8.0.3.i386.rpm
225aa0a619a500eef68c50dc6904584e i386/openssh-clients-3.9p1-8.0.3.i386.rpm
1f961d9889ca730e41094c68df4576fe i386/openssh-server-3.9p1-8.0.3.i386.rpm
abb099c7505111ea5504066413bad8e8 i386/openssh-askpass-3.9p1-8.0.3.i386.rpm
58e19672af45d282ffd664280c77572d i386/openssh-askpass-gnome-3.9p1-8.0.3.i386.rpm
d1a3004d2cdf7b6f89ba2aa4e6d2fbd3 i386/debug/openssh-debuginfo-3.9p1-8.0.3.i386.rpm
References
http://www.vupen.com/english/advisories/2005/1678
http://www.redhat.com/archives/fedora-announce-list/2005-September/msg00021.html
ChangeLog
2005-09-08 : Initial release
Vulnerability Management
Subscribe to VUPEN VNS and receive real-time alerts when new advisories or patches relevant to your systems and network configurations are available.
Feedback
If you have additional information or corrections for this security advisory please submit them via our contact form. | |
|
