Synopsis

openssh bug fix and enhancement update

Type/Severity

Bug Fix Advisory

Topic

Updated openssh packages that fix multiple bugs and add one enhancement are now
available for Red Hat Enterprise Linux 5.

Description

OpenSSH is OpenBSD's Secure Shell (SSH) protocol implementation. These packages
include the core files necessary for the OpenSSH client and server.

This update fixes the following bugs:

• Previously, the SSH daemon (sshd) attempted to bind port 22 to both Internet
  Protocol version 6 (IPv6) and Internet Protocol version 4 (IPv4). As a
  consequence, SSH targeted IPv4 and failed to bind after the second attempt. This
  update uses the IPV6_V6ONLY flag to allow SSH to listen to both on IPv4 and
  IPv6. (BZ#640857)
  
• Previously, SELinux denied /sbin/setfiles access to a leaked SSH tcp_socket
  file descriptor when requested by the restorecon command. This update modifies
  sshd to set the file descriptors flag FD_CLOEXEC on the socket file descriptor.
  Now, sshd no longer leaks any descriptor. (BZ#642935)
  
• Previously, the pubkey_key_verify() function did not detect if it was running
  in a Federal Information Processing Standards (FIPS) environment. As a
  consequence, key-based authentication failed when the FIPS mode was enabled on a
  system. With this update, the pubkey_key_verify() function has been modified to
  respect FIPS. Now, authentication using an RSA key is successful when the FIPS
  mode is enabled. (BZ#674747)
  
• By default, OpenSSH used the /dev/urandom file to reseed the OpenSSL random
  number generator. Prior to this update, this random number generator was
  reseeded only once when the SSH daemon service, the SSH client, or an SSH-aware
  utility was started. To guarantee sufficient entropy, this update modifies the
  underlying source code to reseed the OpenSSL random number generator
  periodically. Additionally, the "SSH_USE_STRONG_RNG" environment variable has
  been added to allow users to specify /dev/random as the random number generator.
  (BZ#681291)
  
• Previously, the SELinux policy did not allow to execute the passwd command
  from sshd directly. With this update, sshd resets the default policy behavior
  before executing the passwd command. (BZ#689406)
  
• Previously, the lastlog command did not correctly report the last login log
  when processing users with User IDs (UIDs) greater than 2147483647. This update
  modifies the underlying code so that lastlog now works for all users.
  (BZ#706315)
  
• Previously, SSH did not send or accept the LANGUAGE environment variable. This
  update adds the SendEnv LANGUAGE option to the SSH configuration file and the
  AcceptEnv option to the sshd configuration file. Now, the environment variable
  LANGUAGE is send and received. (BZ#710229)
  
• Previously, running the mdoc option "groff -m" on OpenSSH manual pages caused
  formatting errors. This update modifies the manual page formatting. Now, the
  mdoc option "groff -m" runs as expected. (BZ#731925)
  
• Prior to this update, the ssh-copy-id script wrongly copied the identity.pub
  key instead of the id_rsa.pub key. This update modifies the underlying code so
  that ssh-copy-id now copies by default the id_rsa.pub key. (BZ#731930)
  
• Previously, SSH clients could, under certain circumstances, wait indefinitely
  at atomicio() in ssh_exchange_identification() when the SSH server stopped
  responding. This update uses the ConnectTimeout parameter to stop SSH clients
  from waiting after timeout. (BZ#750725)
  

This update also adds the following enhancement:

• With this update the umask feature was added to the sftp subsystem to create a
  secure file transfer environment using the sftp service. (BZ#720598)
  

All users of openssh are advised to upgrade to these updated packages, which fix
these bugs and add this enhancement.

Solution

Before applying this update, make sure all previously-released errata relevant
to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red
Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 640857 - ssh throws an error when using default listening due to ipv4 and ipv6
• BZ - 642935 - SELinux is preventing /sbin/setfiles access to a leaked tcp_socket file descriptor.
• BZ - 674747 - cannot login with rsa key on FIPS environment.
• BZ - 706315 - lastlog is not recorded with the big uid
• BZ - 731925 - openssh: formatting errors in manpages
• BZ - 731930 - ssh-copy-id should copy by default id_rsa.pub not identity.pub

CVEs

(none)

References

(none)

Red Hat Enterprise Linux Server 5

SRPM
openssh-4.3p2-82.el5.src.rpm	SHA-256: 4cc07c83fcb1cbff08c056214a82647241f723eb21559487ea52a1f5373a8115
x86_64
openssh-4.3p2-82.el5.x86_64.rpm	SHA-256: 67e0c9fbca1abe9bce53273fe4bf8a91281747729815770f0854c5ab21ebce7f
openssh-askpass-4.3p2-82.el5.x86_64.rpm	SHA-256: e756ceea3d951e7ab730324ad07598f6ad1b646861b92fdd086582d424720311
openssh-clients-4.3p2-82.el5.x86_64.rpm	SHA-256: efd829dd05f37602ee3051b9a26b0a46f5996ac1a213073a6a76e36b228cc4bd
openssh-server-4.3p2-82.el5.x86_64.rpm	SHA-256: 6e328b8687bef5ccf0d18bfce698766b15012d05cb637a81415ea82bc1dfd5cd
ia64
openssh-4.3p2-82.el5.ia64.rpm	SHA-256: 0a14fe37131568643e05c6306acb12e73f1288682ac71d7fe0138ef2800eb0c0
openssh-askpass-4.3p2-82.el5.ia64.rpm	SHA-256: e42ef28c6bc677567c087bdf3c09716157e71fb2c708d8f84196a39a991af92a
openssh-clients-4.3p2-82.el5.ia64.rpm	SHA-256: 570945271c08827cfc66ea0e038f9d6ce9de416489f0cc27808560b07dc07969
openssh-server-4.3p2-82.el5.ia64.rpm	SHA-256: baf2794999fd222490b4af3c25c8fe0cd69aa864f4ed331cc84d3ed10ea62100
i386
openssh-4.3p2-82.el5.i386.rpm	SHA-256: ba034ba9d82c0ea999d4d6d425fff563eaaa11dbd8a864506e1ab0594420bd37
openssh-askpass-4.3p2-82.el5.i386.rpm	SHA-256: 4d634dcad19a4d2dace18ab46846284c8d478b293a1db52cbd6c0e41d1a8e714
openssh-clients-4.3p2-82.el5.i386.rpm	SHA-256: 456c560b97ca20bd9015b05ddafc7ba06f2588088c04c45d318d416df120a004
openssh-server-4.3p2-82.el5.i386.rpm	SHA-256: 6446abc87b1a7291d933cf405eeace5eecec647e8707a69468573ed018bddfbe

Red Hat Enterprise Linux Workstation 5

SRPM
openssh-4.3p2-82.el5.src.rpm	SHA-256: 4cc07c83fcb1cbff08c056214a82647241f723eb21559487ea52a1f5373a8115
x86_64
openssh-4.3p2-82.el5.x86_64.rpm	SHA-256: 67e0c9fbca1abe9bce53273fe4bf8a91281747729815770f0854c5ab21ebce7f
openssh-askpass-4.3p2-82.el5.x86_64.rpm	SHA-256: e756ceea3d951e7ab730324ad07598f6ad1b646861b92fdd086582d424720311
openssh-clients-4.3p2-82.el5.x86_64.rpm	SHA-256: efd829dd05f37602ee3051b9a26b0a46f5996ac1a213073a6a76e36b228cc4bd
openssh-server-4.3p2-82.el5.x86_64.rpm	SHA-256: 6e328b8687bef5ccf0d18bfce698766b15012d05cb637a81415ea82bc1dfd5cd
i386
openssh-4.3p2-82.el5.i386.rpm	SHA-256: ba034ba9d82c0ea999d4d6d425fff563eaaa11dbd8a864506e1ab0594420bd37
openssh-askpass-4.3p2-82.el5.i386.rpm	SHA-256: 4d634dcad19a4d2dace18ab46846284c8d478b293a1db52cbd6c0e41d1a8e714
openssh-clients-4.3p2-82.el5.i386.rpm	SHA-256: 456c560b97ca20bd9015b05ddafc7ba06f2588088c04c45d318d416df120a004
openssh-server-4.3p2-82.el5.i386.rpm	SHA-256: 6446abc87b1a7291d933cf405eeace5eecec647e8707a69468573ed018bddfbe

Red Hat Enterprise Linux Desktop 5

SRPM
openssh-4.3p2-82.el5.src.rpm	SHA-256: 4cc07c83fcb1cbff08c056214a82647241f723eb21559487ea52a1f5373a8115
x86_64
openssh-4.3p2-82.el5.x86_64.rpm	SHA-256: 67e0c9fbca1abe9bce53273fe4bf8a91281747729815770f0854c5ab21ebce7f
openssh-askpass-4.3p2-82.el5.x86_64.rpm	SHA-256: e756ceea3d951e7ab730324ad07598f6ad1b646861b92fdd086582d424720311
openssh-clients-4.3p2-82.el5.x86_64.rpm	SHA-256: efd829dd05f37602ee3051b9a26b0a46f5996ac1a213073a6a76e36b228cc4bd
openssh-server-4.3p2-82.el5.x86_64.rpm	SHA-256: 6e328b8687bef5ccf0d18bfce698766b15012d05cb637a81415ea82bc1dfd5cd
i386
openssh-4.3p2-82.el5.i386.rpm	SHA-256: ba034ba9d82c0ea999d4d6d425fff563eaaa11dbd8a864506e1ab0594420bd37
openssh-askpass-4.3p2-82.el5.i386.rpm	SHA-256: 4d634dcad19a4d2dace18ab46846284c8d478b293a1db52cbd6c0e41d1a8e714
openssh-clients-4.3p2-82.el5.i386.rpm	SHA-256: 456c560b97ca20bd9015b05ddafc7ba06f2588088c04c45d318d416df120a004
openssh-server-4.3p2-82.el5.i386.rpm	SHA-256: 6446abc87b1a7291d933cf405eeace5eecec647e8707a69468573ed018bddfbe

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
openssh-4.3p2-82.el5.src.rpm	SHA-256: 4cc07c83fcb1cbff08c056214a82647241f723eb21559487ea52a1f5373a8115
s390x
openssh-4.3p2-82.el5.s390x.rpm	SHA-256: 3268377bfc4c10500d91f1bf4f471329524dde4825a01593e60797b193480a3f
openssh-askpass-4.3p2-82.el5.s390x.rpm	SHA-256: 6ee135cbb898e88135c3c2c6787fb0ac89aba67b214e6ae7aaaa644c13b7e752
openssh-clients-4.3p2-82.el5.s390x.rpm	SHA-256: 121acb16045b74686312edbb1dfb2351eb361319b10bc6b239f5521df81b65f4
openssh-server-4.3p2-82.el5.s390x.rpm	SHA-256: 976834a472ec46c02c531aceef5a4ad51fb060c66445755f808422f7f677e689

Red Hat Enterprise Linux for Power, big endian 5

SRPM
openssh-4.3p2-82.el5.src.rpm	SHA-256: 4cc07c83fcb1cbff08c056214a82647241f723eb21559487ea52a1f5373a8115
ppc
openssh-4.3p2-82.el5.ppc.rpm	SHA-256: aee03636dee13e0391d34919afe4056ff32e1d7af3848951ac2dead34e5a10a7
openssh-askpass-4.3p2-82.el5.ppc.rpm	SHA-256: 4956e6b5bb169e43269c021ed3ca118e2fa61f905efef59fc8ec1e727e120179
openssh-clients-4.3p2-82.el5.ppc.rpm	SHA-256: e7f2de426a9469822bd100b18b238101770106e3d2b43c244d67b52f07a11bd6
openssh-server-4.3p2-82.el5.ppc.rpm	SHA-256: c4bf9449fb08dcf1883dcec66be11f68cabef50b09ac62190bdf4da77b5cc257

Red Hat Enterprise Linux Server from RHUI 5

SRPM
openssh-4.3p2-82.el5.src.rpm	SHA-256: 4cc07c83fcb1cbff08c056214a82647241f723eb21559487ea52a1f5373a8115
x86_64
openssh-4.3p2-82.el5.x86_64.rpm	SHA-256: 67e0c9fbca1abe9bce53273fe4bf8a91281747729815770f0854c5ab21ebce7f
openssh-askpass-4.3p2-82.el5.x86_64.rpm	SHA-256: e756ceea3d951e7ab730324ad07598f6ad1b646861b92fdd086582d424720311
openssh-clients-4.3p2-82.el5.x86_64.rpm	SHA-256: efd829dd05f37602ee3051b9a26b0a46f5996ac1a213073a6a76e36b228cc4bd
openssh-server-4.3p2-82.el5.x86_64.rpm	SHA-256: 6e328b8687bef5ccf0d18bfce698766b15012d05cb637a81415ea82bc1dfd5cd
i386
openssh-4.3p2-82.el5.i386.rpm	SHA-256: ba034ba9d82c0ea999d4d6d425fff563eaaa11dbd8a864506e1ab0594420bd37
openssh-askpass-4.3p2-82.el5.i386.rpm	SHA-256: 4d634dcad19a4d2dace18ab46846284c8d478b293a1db52cbd6c0e41d1a8e714
openssh-clients-4.3p2-82.el5.i386.rpm	SHA-256: 456c560b97ca20bd9015b05ddafc7ba06f2588088c04c45d318d416df120a004
openssh-server-4.3p2-82.el5.i386.rpm	SHA-256: 6446abc87b1a7291d933cf405eeace5eecec647e8707a69468573ed018bddfbe