[slackware-security]  openssh (SSA:2008-095-01)

New openssh packages are available for Slackware 8.1, 9.0, 9.1,
10.0, 10.1, 10.2, 11.0, 12.0, and -current to fix a security issue.

More details about this issue may be found in the Common
Vulnerabilities and Exposures (CVE) database:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1483


Here are the details from the Slackware 12.0 ChangeLog:
+--------------------------+
patches/packages/openssh-5.0p1-i486-1_slack12.0.tgz:
Upgraded to openssh-5.0p1.
  This version fixes a security issue where local users could hijack forwarded
  X connections.  Upgrading to the new package is highly recommended.
  For more information on this security issue, please see:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1483
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

HINT:  Getting slow download speeds from ftp.slackware.com?
Give slackware.osuosl.org a try.  This is another primary FTP site
for Slackware that can be considerably faster than downloading
directly from ftp.slackware.com.

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating additional FTP and rsync hosting
to the Slackware project!  :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 8.1:
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/openssh-5.0p1-i386-1_slack8.1.tgz

Updated package for Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/openssh-5.0p1-i386-1_slack9.0.tgz

Updated package for Slackware 9.1:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/openssh-5.0p1-i486-1_slack9.1.tgz

Updated package for Slackware 10.0:
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/openssh-5.0p1-i486-1_slack10.0.tgz

Updated package for Slackware 10.1:
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/openssh-5.0p1-i486-1_slack10.1.tgz

Updated package for Slackware 10.2:
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/openssh-5.0p1-i486-1_slack10.2.tgz

Updated package for Slackware 11.0:
ftp://ftp.slackware.com/pub/slackware/slackware-11.0/patches/packages/openssh-5.0p1-i486-1_slack11.0.tgz

Updated package for Slackware 12.0:
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/openssh-5.0p1-i486-1_slack12.0.tgz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/openssh-5.0p1-i486-1.tgz


MD5 signatures:
+-------------+

Slackware 8.1 package:
4a0e0f2293c98fd4ecb2049da7d6c0e7  openssh-5.0p1-i386-1_slack8.1.tgz

Slackware 9.0 package:
c3e5e085a32c916517badda0ade062d6  openssh-5.0p1-i386-1_slack9.0.tgz

Slackware 9.1 package:
375d94c11692403d4ee5b4b051a21610  openssh-5.0p1-i486-1_slack9.1.tgz

Slackware 10.0 package:
4aba1ec2f602618ffdcbde3b249fb05f  openssh-5.0p1-i486-1_slack10.0.tgz

Slackware 10.1 package:
b0edcc0ef8a2de1a14c5492a04fdd931  openssh-5.0p1-i486-1_slack10.1.tgz

Slackware 10.2 package:
0335153a90308f17d83c0e3c24ccd9ee  openssh-5.0p1-i486-1_slack10.2.tgz

Slackware 11.0 package:
e675ba53b97892063ea77b4dfa80dce9  openssh-5.0p1-i486-1_slack11.0.tgz

Slackware 12.0 package:
0712943ea51957cefa9c53d7f74f12e4  openssh-5.0p1-i486-1_slack12.0.tgz

Slackware -current package:
0d22d793f4ce2ab68e9a9b5e9b893e3c  openssh-5.0p1-i486-1.tgz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg openssh-5.0p1-i486-1_slack12.0.tgz

IMPORTANT NOTE:  Before restarting sshd (if you use it), be sure to move
any new /etc/rc.d/rc.sshd into place:

mv /etc/rc.d/rc.sshd.new /etc/rc.d/rc.sshd

Then, make sure that the permissions are correct -- executable if you
want sshd to start at boot, non-executable otherwise.

Finally, restart sshd:

sh /etc/rc.d/rc.sshd restart

This will restart the listener process so that all new connections to
sshd will connect to the new sshd, while old connections will not be
dropped (and may be insecure until they are disconnected and reattached).
Any users who are forwarding X connections through ssh should drop their
connection and log in again.


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com