~ubuntu-branches/ubuntu/dapper/openssh/dapper-security : changes

~ubuntu-branches/ubuntu/dapper/openssh/dapper-security » Changes from revision 14

From Revision 14

Rev	Summary	Authors	Tags	Date
14	* SECURITY UPDATE: block signal handler crash DoS. * SECURITY UPDATE: block signal handler crash DoS. * log.c: backport upstream corrections, thanks to Florian Weimer. * References CVE-2008-4109	Kees Cook	1:4.2p1-7ubuntu3.5	15 years ago
13	* Mitigate OpenSSL security vulnerability (CVE-2008-0166): * Mitigate OpenSSL security vulnerability (CVE-2008-0166): - Add key blacklisting support. Keys listed in /etc/ssh/blacklist.TYPE-LENGTH will be rejected for authentication by sshd, unless "PermitBlacklistedKeys yes" is set in /etc/ssh/sshd_config. - Add a new program, ssh-vulnkey, which can be used to check keys against these blacklists. - Depend on openssh-blacklist.	Colin Watson	1:4.2p1-7ubuntu3.4	15 years ago
12	* SECURITY UPDATE: X11 forward hijacking via alternate addre... * SECURITY UPDATE: X11 forward hijacking via alternate address families. * channels.c: upstream fixes, patched inline. Thanks to Nicolas Valcarcel (LP: #210175). * References CVE-2008-1483	Kees Cook	1:4.2p1-7ubuntu3.3	16 years ago
11	* SECURITY UPDATE: trusted cookie leak when untrusted cookie... * SECURITY UPDATE: trusted cookie leak when untrusted cookie cannot be generated. * clientloop.c: Applied patch according to openssh upstream (LP: #162171), thanks to Stephan Hermann. * References: CVE-2007-4752 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=444738 http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/clientloop.c.diff?r1=1.180&r2=1.181	Kees Cook	1:4.2p1-7ubuntu3.2	16 years ago
10	* SECURITY UPDATE: Remote DoS. * SECURITY UPDATE: Remote DoS. * CVE-2006-4924: Fix a pre-authentication denial of service found by Tavis Ormandy, that would cause sshd(8) to spin until the login grace time expired. Upstream fixes: http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/deattack.c.diff?r1=1.29&r2=1.30&sortby=date&f=h http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/packet.c.diff?r1=1.143&r2=1.144&sortby=date&f=h http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/deattack.h.diff?r1=1.9&r2=1.10&sortby=date&f=h * Fix an unsafe signal hander reported by Mark Dowd. The signal handler was vulnerable to a race condition that could be exploited to perform a pre-authentication denial of service. [CVE-2006-5051] On portable OpenSSH, this vulnerability could theoretically lead to pre-authentication remote code execution if GSSAPI authentication is enabled, but the likelihood of successful exploitation appears remote. [CVE-2006-5052] * Above patches taken from Debian's 4.3p2-4 version, thanks to Colin Watson for backporting them from 4.4p1. * packet.c: Fix a NULL dereference crash so that an appropriate error message is printed on a protocol error. This is not actually a vulnerability, but has been assigned CVE-2006-4925, so let's fix it for completeness' sake. Taken from upstream CVS: http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/packet.c.diff?sortby=date&r2=1.145&r1=1.144&f=h	Martin Pitt	1:4.2p1-7ubuntu3.1	17 years ago
9	On '/etc/init.d/ssh restart', create /var/run/sshd before ch... On '/etc/init.d/ssh restart', create /var/run/sshd before checking the server configuration, as otherwise 'sshd -t' will complain about the lack of /var/run/sshd (closes: Malone #45234).	Colin Watson	1:4.2p1-7ubuntu3	17 years ago
8	* Backport from OpenSSH 4.3 (closes: Malone #25528): * Backport from OpenSSH 4.3 (closes: Malone #25528): - Set SO_REUSEADDR on X11 listeners to avoid problems caused by lingering sockets from previous session (X11 applications can sometimes not connect to 127.0.0.1:60xx).	Colin Watson	1:4.2p1-7ubuntu2	17 years ago
7	Resynchronise with Debian. Resynchronise with Debian.	Colin Watson	1:4.2p1-7ubuntu1	18 years ago
6	* SECURITY UPDATE: Shell code injection with crafted file na... * SECURITY UPDATE: Shell code injection with crafted file names in scp. * Ported upstream patch from 4.3p2 to replace system() call with a proper exec() call; this avoids expanding shell metacharacters in local-to-local or remote-to-remote copies. * CVE-2006-0225	Martin Pitt	1:4.2p1-5ubuntu2	18 years ago
5	Resynchronise with Debian. Resynchronise with Debian.	Colin Watson	1:4.2p1-5ubuntu1	18 years ago
4	* Add /usr/games to the default $PATH for non-privileged use... * Add /usr/games to the default $PATH for non-privileged users. * Explicitly tell po2debconf to use the 'popular' output encoding, to avoid huge automatic changes to debian/po/*.po with po-debconf 0.9.0.	Colin Watson	1:4.1p1-7ubuntu4	18 years ago
3	Don't ask unnecessary and misplaced ssh/forward_warning debc... Don't ask unnecessary and misplaced ssh/forward_warning debconf note (closes: Ubuntu #7363).	Colin Watson	1:3.9p1-1ubuntu2	19 years ago
2	* Nathaniel McCallum: * Nathaniel McCallum: - debian/openssh-server.init: pretty initscript - debian/control: versioned depend on lsb-base	Colin Watson	1:3.8.1p1-11ubuntu3	19 years ago
1	Import upstream version 3.8.1p1 Import upstream version 3.8.1p1	Noah Meyerhans	upstream-3.8.1p1	17 years ago