LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Advisory Watch: October 24th, 2014
Linux Security Week: October 20th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Debian: 'ssh' Privilege escalation vulnerability Print E-mail
User Rating:      How can I rate this item?
Posted by LinuxSecurity.com Team   
Debian If the UseLogin feature is enabled in for ssh local users couldpass environment variables (including variables like LD_PRELOAD)to the login process.

------------------------------------------------------------------------
Debian Security Advisory DSA-091-1                   security@debian.org 
http://www.debian.org/security/                         Wichert Akkerman
December  5, 2001
------------------------------------------------------------------------


Package        : ssh
Problem type   : influencing login
Debian-specific: no

If the UseLogin feature is enabled in for ssh local users could
pass environment variables (including variables like LD_PRELOAD)
to the login process. This has been fixed by not copying the
environment of UseLogin is enabled.

Please note that the default configuration for Debian does not
have the UseLogin enabled.

This has been fixed in version 1:1.2.3-9.4.


wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.


Debian GNU/Linux 2.2 alias potato
---------------------------------

  Potato was released for alpha, arm, i386, m68k, powerpc and sparc.

  Source archives:
     http://security.debian.org/dists/stable/updates/main/source/openssh_1.2.3-9.4.diff.gz
      MD5 checksum: a3600ed331f986cf4c9e8999bc5d69cb
     http://security.debian.org/dists/stable/updates/main/source/openssh_1.2.3-9.4.dsc
      MD5 checksum: 30c2e9775b9bbb214afd95a731e0f482
     http://security.debian.org/dists/stable/updates/main/source/openssh_1.2.3.orig.tar.gz
      MD5 checksum: 6aad0cc9ceca55f138ed1ba4cf660349

  Architecture independent archives:
     
http://security.debian.org/dists/stable/updates/main/binary-all/ssh-askpass-ptk_1.2.3-9.4_all.deb
      MD5 checksum: eb61f2cbd0a985ad91460676c54e8234

  Alpha architecture:
     
http://security.debian.org/dists/stable/updates/main/binary-alpha/ssh-askpass-gnome_1.2.3-9.4_alpha.deb
      MD5 checksum: a1ff36aea22f0c93c6800fb1a282c15a
     http://security.debian.org/dists/stable/updates/main/binary-alpha/ssh_1.2.3-9.4_alpha.deb
      MD5 checksum: 5cae8437e415dd274d9de6ad86bd293a

  ARM architecture:
     
http://security.debian.org/dists/stable/updates/main/binary-arm/ssh-askpass-gnome_1.2.3-9.4_arm.deb
      MD5 checksum: 5d5df2cda09d9edaf17c24d5cfe7c4a3
     http://security.debian.org/dists/stable/updates/main/binary-arm/ssh_1.2.3-9.4_arm.deb
      MD5 checksum: 88eaecbcf5f1e2a8fc4a1a5bffb7dad2

  Intel IA-32 architecture:
     
http://security.debian.org/dists/stable/updates/main/binary-i386/ssh-askpass-gnome_1.2.3-9.4_i386.deb
      MD5 checksum: 174cc64dbb0996cd09d58f2691817dbf
     http://security.debian.org/dists/stable/updates/main/binary-i386/ssh_1.2.3-9.4_i386.deb
      MD5 checksum: 1426d1c8d424b8af6e94a1eec87075aa

  Motorola 680x0 architecture:
     
http://security.debian.org/dists/stable/updates/main/binary-m68k/ssh-askpass-gnome_1.2.3-9.4_m68k.deb
      MD5 checksum: 78c897a689e04ffd20e1b0230b85f452
     http://security.debian.org/dists/stable/updates/main/binary-m68k/ssh_1.2.3-9.4_m68k.deb
      MD5 checksum: e0ca14452953a318dec512b739f8fec4

  PowerPC architecture:
     
http://security.debian.org/dists/stable/updates/main/binary-powerpc/ssh-askpass-gnome_1.2.3-9.4_powerpc.deb
      MD5 checksum: 17bdb2cc2381defd4fb10bb963de9c19
     
http://security.debian.org/dists/stable/updates/main/binary-powerpc/ssh_1.2.3-9.4_powerpc.deb
      MD5 checksum: 8f80b6a56f437589edbeb0ca2c3321e3

  Sun Sparc architecture:
     
http://security.debian.org/dists/stable/updates/main/binary-sparc/ssh-askpass-gnome_1.2.3-9.4_sparc.deb
      MD5 checksum: a65d2465bb5372a5153b2c5afd4929ec
     http://security.debian.org/dists/stable/updates/main/binary-sparc/ssh_1.2.3-9.4_sparc.deb
      MD5 checksum: 687aa2c7dd8295b1c6bb0cac5d6c6c06

  These packages will be moved into the stable distribution on its next
  revision.

For not yet released architectures please refer to the appropriate
directory  ftp://ftp.debian.org/debian/dists/sid/binary-$arch/ .

--
----------------------------------------------------------------------------
apt-get: deb  http://security.debian.org/ stable/updates main
dpkg-ftp:  ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org



 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Pro-Privacy Senator Wyden on Fighting the NSA From Inside the System
NIST to hypervisor admins: secure your systems
Quick PHP patch beats slow research reveal
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.