lp:ubuntu/dapper-security/openssh

Created by James Westby on 2009-12-02 and last modified on 2009-12-02
Get this branch:
bzr branch lp:ubuntu/dapper-security/openssh
Members of Ubuntu branches can upload to this branch. Log in for directions.

Branch merges

Related bugs

Related blueprints

Branch information

Owner:
Ubuntu branches
Review team:
Ubuntu Development Team
Status:
Mature

Recent revisions

14. By Kees Cook on 2008-09-29

* SECURITY UPDATE: block signal handler crash DoS.
* log.c: backport upstream corrections, thanks to Florian Weimer.
* References
  CVE-2008-4109

13. By Colin Watson on 2008-05-17

* Mitigate OpenSSL security vulnerability (CVE-2008-0166):
  - Add key blacklisting support. Keys listed in
    /etc/ssh/blacklist.TYPE-LENGTH will be rejected for authentication by
    sshd, unless "PermitBlacklistedKeys yes" is set in
    /etc/ssh/sshd_config.
  - Add a new program, ssh-vulnkey, which can be used to check keys
    against these blacklists.
  - Depend on openssh-blacklist.

12. By Kees Cook on 2008-04-01

* SECURITY UPDATE: X11 forward hijacking via alternate address families.
* channels.c: upstream fixes, patched inline. Thanks to Nicolas Valcarcel
  (LP: #210175).
* References
  CVE-2008-1483

11. By Kees Cook on 2008-01-09

* SECURITY UPDATE: trusted cookie leak when untrusted cookie cannot be
  generated.
* clientloop.c: Applied patch according to openssh upstream (LP: #162171),
  thanks to Stephan Hermann.
* References:
  CVE-2007-4752
  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=444738
  http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/clientloop.c.diff?r1=1.180&r2=1.181

10. By Martin Pitt on 2006-10-02

* SECURITY UPDATE: Remote DoS.
* CVE-2006-4924: Fix a pre-authentication denial of service found by
  Tavis Ormandy, that would cause sshd(8) to spin until the login grace
  time expired.
  Upstream fixes:
  http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/deattack.c.diff?r1=1.29&r2=1.30&sortby=date&f=h
  http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/packet.c.diff?r1=1.143&r2=1.144&sortby=date&f=h
  http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/deattack.h.diff?r1=1.9&r2=1.10&sortby=date&f=h
* Fix an unsafe signal hander reported by Mark Dowd. The
  signal handler was vulnerable to a race condition that could be
  exploited to perform a pre-authentication denial of service. [CVE-2006-5051]
  On portable OpenSSH, this vulnerability could theoretically lead to
  pre-authentication remote code execution if GSSAPI authentication is
  enabled, but the likelihood of successful exploitation appears remote.
  [CVE-2006-5052]
* Above patches taken from Debian's 4.3p2-4 version, thanks to Colin Watson
  for backporting them from 4.4p1.
* packet.c: Fix a NULL dereference crash so that an appropriate error
  message is printed on a protocol error. This is not actually a
  vulnerability, but has been assigned CVE-2006-4925, so let's fix it for
  completeness' sake.
  Taken from upstream CVS:
  http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/packet.c.diff?sortby=date&r2=1.145&r1=1.144&f=h

9. By Colin Watson on 2006-05-17

On '/etc/init.d/ssh restart', create /var/run/sshd before checking the
server configuration, as otherwise 'sshd -t' will complain about the
lack of /var/run/sshd (closes: Malone #45234).

8. By Colin Watson on 2006-05-12

* Backport from OpenSSH 4.3 (closes: Malone #25528):
  - Set SO_REUSEADDR on X11 listeners to avoid problems caused by
    lingering sockets from previous session (X11 applications can
    sometimes not connect to 127.0.0.1:60xx).

7. By Colin Watson on 2006-03-01

Resynchronise with Debian.

6. By Martin Pitt on 2006-02-20

* SECURITY UPDATE: Shell code injection with crafted file names in scp.
* Ported upstream patch from 4.3p2 to replace system() call with a proper
  exec() call; this avoids expanding shell metacharacters in local-to-local
  or remote-to-remote copies.
* CVE-2006-0225

5. By Colin Watson on 2005-10-31

Resynchronise with Debian.

Branch metadata

Branch format:
Branch format 7
Repository format:
Bazaar repository format 2a (needs bzr 1.16 or later)
Stacked on:
lp:ubuntu/lucid/openssh
This branch contains Public information 
Everyone can see this information.

Subscribers