-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2013:051 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : openssh Date : April 5, 2013 Affected: Business Server 1.0 _______________________________________________________________________ Problem Description: A vulnerability has been found and corrected in openssh: The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections (CVE-2010-5107). The updated packages have been patched to correct thies issue. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5107 _______________________________________________________________________ Updated Packages: Mandriva Business Server 1/X86_64: 490cc20f62d9041848fecc0d113929c7 mbs1/x86_64/openssh-5.9p1-6.1.mbs1.x86_64.rpm 15fda9cfa94392e3335045b77cabc454 mbs1/x86_64/openssh-askpass-5.9p1-6.1.mbs1.x86_64.rpm 166e9356916ff90fea38e062a38f3c46 mbs1/x86_64/openssh-askpass-common-5.9p1-6.1.mbs1.x86_64.rpm 3e89fdee6676cad1a367bcb08d2a0598 mbs1/x86_64/openssh-askpass-gnome-5.9p1-6.1.mbs1.x86_64.rpm da53e32963914ebd5ef2a711f9eb17b8 mbs1/x86_64/openssh-clients-5.9p1-6.1.mbs1.x86_64.rpm 5fcf1ae9ec65ab8a6caef1ddae3995a2 mbs1/x86_64/openssh-server-5.9p1-6.1.mbs1.x86_64.rpm 02d438c1966e5e0d3dac8ff4410a13aa mbs1/SRPMS/openssh-5.9p1-6.1.mbs1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFRXtDnmqjQ0CJFipgRAiEwAKDANOQ12kc1Nib9bMp8im8/Bu74zwCdHdVK zwL21LZmABNE+map1B9vXdQ= =ccb1 -----END PGP SIGNATURE-----
