RHBA-2010:0193 - Bug Fix Advisory

Topic

Updated openssh packages that fix various bugs and add an enhancement are
now available.

Description

OpenSSH is OpenBSD's SSH (Secure Shell) protocol implementation. These
packages include the core files necessary for both the OpenSSH client and
server.

These packages address the following bugs:

• When sshd used multiple SFTP channels simultaneously, each SFTP channel

leaked a unix socket. This socket leak could have eventually caused the
sshd daemon to monopolize system resources. The bug has been fixed with
these updated packages by ensuring that there is no socket leak within a
subsystem. (BZ#530358)

• If a zero length SSH2 DSA key existed, the ssh init script would hang.

This issue has been fixed by allowing the ssh init script to automatically
overwrite any zero length keys that exist. The ssh init script now
functions as expected, even if a zero length key exists before execution of
the script. (BZ#531738)

As well, these updated packages add the following enhancement:

• A call to RAND_cleanup() has been added to ssh and sshd to clean the PRNG

status when exiting the program. This enhancement also ensures FIPS-140-2
compliance. (BZ#557164)

All openssh users should upgrade to these updated packages, which resolve
these issues.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 530358 - sshd leaks a unix socket after each use of a sftp channel
• BZ - 531738 - System hangs when generating SSH2 DSA key

CVEs

(none)

References

(none)