Synopsis

Low: openssh security update

Type/Severity

Security Advisory: Low

Topic

Updated openssh packages that fix an authentication flaw are now available
for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having low security impact by the Red Hat
Security Response Team.

Description

OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. This
package includes the core files necessary for both the OpenSSH client and
server.

An authentication flaw was found in OpenSSH's privilege separation monitor.
If it ever becomes possible to alter the behavior of the unprivileged
process when OpenSSH is using privilege separation, an attacker may then be
able to login without possessing proper credentials. (CVE-2006-5794)

Please note that this flaw by itself poses no direct threat to OpenSSH
users. Without another security flaw that could allow an attacker to alter
the behavior of OpenSSH's unprivileged process, this flaw cannot be
exploited. There are currently no known flaws to exploit this behavior.
However, we have decided to issue this erratum to fix this flaw to reduce
the security impact if an unprivileged process flaw is ever found.

Users of openssh should upgrade to these updated packages, which contain a
backported patch to resolve this issue.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server 3 x86_64
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server 3 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian 3 ppc

Fixes

• BZ - 214640 - CVE-2006-5794 OpenSSH privilege separation flaw

CVEs

• CVE-2006-5794

References

• http://www.redhat.com/security/updates/classification/#low

Red Hat Enterprise Linux Server 4

SRPM
openssh-3.9p1-8.RHEL4.17.1.src.rpm	SHA-256: 0a4477e4e1a566e0e0180e38d87e4d1f695bf19c83794b0e53c6ea8a44697cbf
x86_64
openssh-3.9p1-8.RHEL4.17.1.x86_64.rpm	SHA-256: 903861a40020751b55640c14296050df8895301066cd989f92881bbf8ba9cd59
openssh-3.9p1-8.RHEL4.17.1.x86_64.rpm	SHA-256: 903861a40020751b55640c14296050df8895301066cd989f92881bbf8ba9cd59
openssh-askpass-3.9p1-8.RHEL4.17.1.x86_64.rpm	SHA-256: 61722fef79fd20a0b4bab4fd9b64b08a82986fcf2f31a403a3a10a5b6cdb6867
openssh-askpass-3.9p1-8.RHEL4.17.1.x86_64.rpm	SHA-256: 61722fef79fd20a0b4bab4fd9b64b08a82986fcf2f31a403a3a10a5b6cdb6867
openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.x86_64.rpm	SHA-256: 3fce917261a61c33d1e62232c4a289be76285c72a407338121448622c70d4904
openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.x86_64.rpm	SHA-256: 3fce917261a61c33d1e62232c4a289be76285c72a407338121448622c70d4904
openssh-clients-3.9p1-8.RHEL4.17.1.x86_64.rpm	SHA-256: 9969c5d1566158480f8b239da1223079e7ffd5d4b6f3efc28983f5deb245f9a9
openssh-clients-3.9p1-8.RHEL4.17.1.x86_64.rpm	SHA-256: 9969c5d1566158480f8b239da1223079e7ffd5d4b6f3efc28983f5deb245f9a9
openssh-server-3.9p1-8.RHEL4.17.1.x86_64.rpm	SHA-256: e9df8ab5339928f6cef28bfe0a2287547175e1397559398f6f0ec6d343a3effc
openssh-server-3.9p1-8.RHEL4.17.1.x86_64.rpm	SHA-256: e9df8ab5339928f6cef28bfe0a2287547175e1397559398f6f0ec6d343a3effc
ia64
openssh-3.9p1-8.RHEL4.17.1.ia64.rpm	SHA-256: 3993695bc77e0857e3964943ec229cdb257c6f53492459c1174c566e16a58c17
openssh-3.9p1-8.RHEL4.17.1.ia64.rpm	SHA-256: 3993695bc77e0857e3964943ec229cdb257c6f53492459c1174c566e16a58c17
openssh-askpass-3.9p1-8.RHEL4.17.1.ia64.rpm	SHA-256: 198f85f21c3d45a1d3cbafb3f6277ee6397b8a76165b2d665c89fbd50d9ce4d3
openssh-askpass-3.9p1-8.RHEL4.17.1.ia64.rpm	SHA-256: 198f85f21c3d45a1d3cbafb3f6277ee6397b8a76165b2d665c89fbd50d9ce4d3
openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.ia64.rpm	SHA-256: 6f4705ae12a5a433da8305f741604d6e807f1c368cd88e8c5ccd232f1e81d463
openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.ia64.rpm	SHA-256: 6f4705ae12a5a433da8305f741604d6e807f1c368cd88e8c5ccd232f1e81d463
openssh-clients-3.9p1-8.RHEL4.17.1.ia64.rpm	SHA-256: 1b15363414af6eb3401ec308e71a4a31e4511aae0600aad0a3ef9aab207e4ecc
openssh-clients-3.9p1-8.RHEL4.17.1.ia64.rpm	SHA-256: 1b15363414af6eb3401ec308e71a4a31e4511aae0600aad0a3ef9aab207e4ecc
openssh-server-3.9p1-8.RHEL4.17.1.ia64.rpm	SHA-256: e34c35c658a9ed559127918b22247c0185cc136314023d8fd7ec210d686d2dac
openssh-server-3.9p1-8.RHEL4.17.1.ia64.rpm	SHA-256: e34c35c658a9ed559127918b22247c0185cc136314023d8fd7ec210d686d2dac
i386
openssh-3.9p1-8.RHEL4.17.1.i386.rpm	SHA-256: c4359d170a14ba722bd26d05185a188e78798e4996bd48c26bcc9ebf1168b893
openssh-3.9p1-8.RHEL4.17.1.i386.rpm	SHA-256: c4359d170a14ba722bd26d05185a188e78798e4996bd48c26bcc9ebf1168b893
openssh-askpass-3.9p1-8.RHEL4.17.1.i386.rpm	SHA-256: e0ebc43ded975baa1b50b933def6bcea9bfd074e883b3c9c7407a9a32f68a01f
openssh-askpass-3.9p1-8.RHEL4.17.1.i386.rpm	SHA-256: e0ebc43ded975baa1b50b933def6bcea9bfd074e883b3c9c7407a9a32f68a01f
openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.i386.rpm	SHA-256: 3181a8e3b0b6854a05f4a5f6643f9d43b24f2db7d94951c136d748e056251fdc
openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.i386.rpm	SHA-256: 3181a8e3b0b6854a05f4a5f6643f9d43b24f2db7d94951c136d748e056251fdc
openssh-clients-3.9p1-8.RHEL4.17.1.i386.rpm	SHA-256: b1ddb8984b30218f655fbe37a28e4fd3c2463108e4cb123cee7b90156753f8b2
openssh-clients-3.9p1-8.RHEL4.17.1.i386.rpm	SHA-256: b1ddb8984b30218f655fbe37a28e4fd3c2463108e4cb123cee7b90156753f8b2
openssh-server-3.9p1-8.RHEL4.17.1.i386.rpm	SHA-256: 11716ae5a6d92966cb35635482a7d8be2c140203bb741ef5870ffcd965ffd09e
openssh-server-3.9p1-8.RHEL4.17.1.i386.rpm	SHA-256: 11716ae5a6d92966cb35635482a7d8be2c140203bb741ef5870ffcd965ffd09e

Red Hat Enterprise Linux Workstation 4

SRPM
openssh-3.9p1-8.RHEL4.17.1.src.rpm	SHA-256: 0a4477e4e1a566e0e0180e38d87e4d1f695bf19c83794b0e53c6ea8a44697cbf
x86_64
openssh-3.9p1-8.RHEL4.17.1.x86_64.rpm	SHA-256: 903861a40020751b55640c14296050df8895301066cd989f92881bbf8ba9cd59
openssh-askpass-3.9p1-8.RHEL4.17.1.x86_64.rpm	SHA-256: 61722fef79fd20a0b4bab4fd9b64b08a82986fcf2f31a403a3a10a5b6cdb6867
openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.x86_64.rpm	SHA-256: 3fce917261a61c33d1e62232c4a289be76285c72a407338121448622c70d4904
openssh-clients-3.9p1-8.RHEL4.17.1.x86_64.rpm	SHA-256: 9969c5d1566158480f8b239da1223079e7ffd5d4b6f3efc28983f5deb245f9a9
openssh-server-3.9p1-8.RHEL4.17.1.x86_64.rpm	SHA-256: e9df8ab5339928f6cef28bfe0a2287547175e1397559398f6f0ec6d343a3effc
ia64
openssh-3.9p1-8.RHEL4.17.1.ia64.rpm	SHA-256: 3993695bc77e0857e3964943ec229cdb257c6f53492459c1174c566e16a58c17
openssh-askpass-3.9p1-8.RHEL4.17.1.ia64.rpm	SHA-256: 198f85f21c3d45a1d3cbafb3f6277ee6397b8a76165b2d665c89fbd50d9ce4d3
openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.ia64.rpm	SHA-256: 6f4705ae12a5a433da8305f741604d6e807f1c368cd88e8c5ccd232f1e81d463
openssh-clients-3.9p1-8.RHEL4.17.1.ia64.rpm	SHA-256: 1b15363414af6eb3401ec308e71a4a31e4511aae0600aad0a3ef9aab207e4ecc
openssh-server-3.9p1-8.RHEL4.17.1.ia64.rpm	SHA-256: e34c35c658a9ed559127918b22247c0185cc136314023d8fd7ec210d686d2dac
i386
openssh-3.9p1-8.RHEL4.17.1.i386.rpm	SHA-256: c4359d170a14ba722bd26d05185a188e78798e4996bd48c26bcc9ebf1168b893
openssh-askpass-3.9p1-8.RHEL4.17.1.i386.rpm	SHA-256: e0ebc43ded975baa1b50b933def6bcea9bfd074e883b3c9c7407a9a32f68a01f
openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.i386.rpm	SHA-256: 3181a8e3b0b6854a05f4a5f6643f9d43b24f2db7d94951c136d748e056251fdc
openssh-clients-3.9p1-8.RHEL4.17.1.i386.rpm	SHA-256: b1ddb8984b30218f655fbe37a28e4fd3c2463108e4cb123cee7b90156753f8b2
openssh-server-3.9p1-8.RHEL4.17.1.i386.rpm	SHA-256: 11716ae5a6d92966cb35635482a7d8be2c140203bb741ef5870ffcd965ffd09e

Red Hat Enterprise Linux Desktop 4

SRPM
openssh-3.9p1-8.RHEL4.17.1.src.rpm	SHA-256: 0a4477e4e1a566e0e0180e38d87e4d1f695bf19c83794b0e53c6ea8a44697cbf
x86_64
openssh-3.9p1-8.RHEL4.17.1.x86_64.rpm	SHA-256: 903861a40020751b55640c14296050df8895301066cd989f92881bbf8ba9cd59
openssh-askpass-3.9p1-8.RHEL4.17.1.x86_64.rpm	SHA-256: 61722fef79fd20a0b4bab4fd9b64b08a82986fcf2f31a403a3a10a5b6cdb6867
openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.x86_64.rpm	SHA-256: 3fce917261a61c33d1e62232c4a289be76285c72a407338121448622c70d4904
openssh-clients-3.9p1-8.RHEL4.17.1.x86_64.rpm	SHA-256: 9969c5d1566158480f8b239da1223079e7ffd5d4b6f3efc28983f5deb245f9a9
openssh-server-3.9p1-8.RHEL4.17.1.x86_64.rpm	SHA-256: e9df8ab5339928f6cef28bfe0a2287547175e1397559398f6f0ec6d343a3effc
i386
openssh-3.9p1-8.RHEL4.17.1.i386.rpm	SHA-256: c4359d170a14ba722bd26d05185a188e78798e4996bd48c26bcc9ebf1168b893
openssh-askpass-3.9p1-8.RHEL4.17.1.i386.rpm	SHA-256: e0ebc43ded975baa1b50b933def6bcea9bfd074e883b3c9c7407a9a32f68a01f
openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.i386.rpm	SHA-256: 3181a8e3b0b6854a05f4a5f6643f9d43b24f2db7d94951c136d748e056251fdc
openssh-clients-3.9p1-8.RHEL4.17.1.i386.rpm	SHA-256: b1ddb8984b30218f655fbe37a28e4fd3c2463108e4cb123cee7b90156753f8b2
openssh-server-3.9p1-8.RHEL4.17.1.i386.rpm	SHA-256: 11716ae5a6d92966cb35635482a7d8be2c140203bb741ef5870ffcd965ffd09e

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
openssh-3.9p1-8.RHEL4.17.1.src.rpm	SHA-256: 0a4477e4e1a566e0e0180e38d87e4d1f695bf19c83794b0e53c6ea8a44697cbf
s390x
openssh-3.9p1-8.RHEL4.17.1.s390x.rpm	SHA-256: 6b6ef66d7c920028b095f0adb49e6b3dc720c955df546fa273164a7ed51ffdd6
openssh-askpass-3.9p1-8.RHEL4.17.1.s390x.rpm	SHA-256: 2456d57894cc474448077a4c602b396c8356ab0d0cfc68fe914c8439f92160e5
openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.s390x.rpm	SHA-256: c6ab0fe6c852bfe141cbb68e6fd159fd85bb9ad45c81733483fcec44f38f931a
openssh-clients-3.9p1-8.RHEL4.17.1.s390x.rpm	SHA-256: 6b34096436d9ffde2658e9b3ffed2292fb25b6732d6d2784ac4bc093a4647070
openssh-server-3.9p1-8.RHEL4.17.1.s390x.rpm	SHA-256: 99088df8ad5cdb760476aca56a5153dd64e49468a7209ddc267cf88311c1d679
s390
openssh-3.9p1-8.RHEL4.17.1.s390.rpm	SHA-256: 12c0acef83866b38266399a0f111ef47a6addb769dff69634703ab0105b0aa4d
openssh-askpass-3.9p1-8.RHEL4.17.1.s390.rpm	SHA-256: c9dec05ed4f0522bfe824f4ab1a8afc8b6ac8376a6c66cf60bd37d616a96b32a
openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.s390.rpm	SHA-256: 9bb33829c802ca484ba826f524074702e50ebafbd644ca3f3738c757ba500526
openssh-clients-3.9p1-8.RHEL4.17.1.s390.rpm	SHA-256: a3775fa26545a11992b2c70f9589930bbe36661775c1718534bbd7d8dac89b11
openssh-server-3.9p1-8.RHEL4.17.1.s390.rpm	SHA-256: 8ab98c80ef6256d29c14eb54b10a07feef4e062156984d1d6e57cb5bdd17dc8a

Red Hat Enterprise Linux for Power, big endian 4

SRPM
openssh-3.9p1-8.RHEL4.17.1.src.rpm	SHA-256: 0a4477e4e1a566e0e0180e38d87e4d1f695bf19c83794b0e53c6ea8a44697cbf
ppc
openssh-3.9p1-8.RHEL4.17.1.ppc.rpm	SHA-256: 9e8e12e9fa367e854c6f8d05bafd500be2efbde9349c69ef4a6205ef9400abee
openssh-askpass-3.9p1-8.RHEL4.17.1.ppc.rpm	SHA-256: 5481e8acf31db85e72faae476f364d0c0a77aad1ce56bd67a8c5e04b01a22ab4
openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.ppc.rpm	SHA-256: c0a7959451f7a50700aa6cd2db9d6c9b585a8357ff93439691f1dfd7411f8514
openssh-clients-3.9p1-8.RHEL4.17.1.ppc.rpm	SHA-256: a173eaaf05ec769b7f288855070181f8f964c370c4df6b3d4cbe1816ba5778e8
openssh-server-3.9p1-8.RHEL4.17.1.ppc.rpm	SHA-256: c465f2ba0379102088e849f6944e4e1963aa6dabd2f034f0647e61e19cff0106