RHBA-2011:1551 - Bug Fix Advisory

Topic

Updated openssh packages that fix multiple bugs and add one enhancement are now
available for Red Hat Enterprise Linux 6.

Description

OpenSSH is OpenBSD's Secure Shell (SSH) protocol implementation. These packages
include the core files necessary for the OpenSSH client and server.

This update fixes the following bugs:

• Prior to this update, SELinux could prevent users from uploading new files to

their home directories in a chrooted Secure File Transfer Protocol (SFTP)
environment. This bug has been fixed and users are now able to upload and
download files in chrooted environment using SFTP. (BZ#685060)

• Prior to this update, multiple manual pages contained formatting errors. As a

consequence, error messages or warnings could be displayed when viewing these
manual pages. The formatting has been corrected and the error messages and
warnings are no longer displayed.(BZ#705397, BZ#728459)

• Previously, when the SSH_USE_STRONG_RNG environment variable was set to 1,

openssh read 48 bytes from the /dev/random number generator to generate a seed.
This seed was too long and caused long delays on ssh or sshd startup and when
connections were received. Now, the SSH_USE_STRONG_RNG variable contains the
number of bytes that should be pulled from /dev/random (with a minimum default
value of six) and the delays no longer occur. (BZ#708056)

• Previously, when restarting the dovecot service, ssh could become

unresponsive. With this update, the source code is modified and the dovecot
service now restarts properly and without hanging. (BZ#714554)

• Prior to this update, the debuginfo file was missing in the debuginfo package.

With this update, the debuginfo file is included in the package and users can
now view all debug information. (BZ#729021)

• Previously, the lastlog command did not show the last login of a user with a

big user ID on 32-bit architectures. With this update, the source code is
modified so that the last login information is now always recorded. (BZ#731939)

This update also adds the following enhancement:

• With this update, multiple manual pages now describe Internet Protocol version

6 (IPv6) usage. (BZ#695781)

All users of openssh are advised to upgrade to these updated packages, which fix
these bugs and add this enhancement.

Solution

Before applying this update, make sure all previously-released errata relevant
to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red
Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x

Fixes

• BZ - 685060 - In a chrooted sftp environment, selinux is preventing the users from uploading new files to their home directories.
• BZ - 695781 - [RFE] Clarify IPv6 usage in ssh, scp, sftp man pages
• BZ - 705397 - openssh: formatting errors in openssh-ldap manpages
• BZ - 708389 - [RFE] make it possible to build openssh without downstream patches
• BZ - 714554 - starting dovecot service from ssh command line does not return
• BZ - 728459 - openssh: formatting errors in various manpages
• BZ - 729021 - Debug file missing in debuginfo package for a binary
• BZ - 731939 - lastlog is not recorded with the big uid on i686 architecture

CVEs

(none)

References

(none)