-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[slackware-security] openssh (SSA:2016-219-03)
New openssh packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1,
14.2, and -current to fix security issues.
Here are the details from the Slackware 14.2 ChangeLog:
+--------------------------+
patches/packages/openssh-7.3p1-i586-1_slack14.2.txz: Upgraded.
This is primarily a bugfix release, and also addresses security issues.
sshd(8): Mitigate a potential denial-of-service attack against the system's
crypt(3) function via sshd(8).
sshd(8): Mitigate timing differences in password authentication that could
be used to discern valid from invalid account names when long passwords were
sent and particular password hashing algorithms are in use on the server.
ssh(1), sshd(8): Fix observable timing weakness in the CBC padding oracle
countermeasures.
ssh(1), sshd(8): Improve operation ordering of MAC verification for
Encrypt-then-MAC (EtM) mode transport MAC algorithms to verify the MAC
before decrypting any ciphertext.
sshd(8): (portable only) Ignore PAM environment vars when UseLogin=yes.
For more information, see:
http://www.openssh.com/txt/release-7.3
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6210
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8325
(* Security fix *)
+--------------------------+
Where to find the new packages:
+-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.
Updated package for Slackware 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/openssh-7.3p1-i486-1_slack13.0.txz
Updated package for Slackware x86_64 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/openssh-7.3p1-x86_64-1_slack13.0.txz
Updated package for Slackware 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/openssh-7.3p1-i486-1_slack13.1.txz
Updated package for Slackware x86_64 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/openssh-7.3p1-x86_64-1_slack13.1.txz
Updated package for Slackware 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/openssh-7.3p1-i486-1_slack13.37.txz
Updated package for Slackware x86_64 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/openssh-7.3p1-x86_64-1_slack13.37.txz
Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/openssh-7.3p1-i486-1_slack14.0.txz
Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/openssh-7.3p1-x86_64-1_slack14.0.txz
Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/openssh-7.3p1-i486-1_slack14.1.txz
Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/openssh-7.3p1-x86_64-1_slack14.1.txz
Updated package for Slackware 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/openssh-7.3p1-i586-1_slack14.2.txz
Updated package for Slackware x86_64 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/openssh-7.3p1-x86_64-1_slack14.2.txz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/openssh-7.3p1-i586-1.txz
Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/openssh-7.3p1-x86_64-1.txz
MD5 signatures:
+-------------+
Slackware 13.0 package:
926a45f63599a8f7d559039220f2773c openssh-7.3p1-i486-1_slack13.0.txz
Slackware x86_64 13.0 package:
2f18a3adf8ed54e59ac0c0740b138a67 openssh-7.3p1-x86_64-1_slack13.0.txz
Slackware 13.1 package:
7f5e48238b26237b9c2542a3d34847b6 openssh-7.3p1-i486-1_slack13.1.txz
Slackware x86_64 13.1 package:
e277d7c7865fd46bc48ac128849d6426 openssh-7.3p1-x86_64-1_slack13.1.txz
Slackware 13.37 package:
17c49c75c5d2b6ad49e0d2352fd2e922 openssh-7.3p1-i486-1_slack13.37.txz
Slackware x86_64 13.37 package:
6305b5ce1ce3a4390a56c36eca6920cc openssh-7.3p1-x86_64-1_slack13.37.txz
Slackware 14.0 package:
508dbde12ca36275d305ad1014f12066 openssh-7.3p1-i486-1_slack14.0.txz
Slackware x86_64 14.0 package:
699e2c1d8d7383ba2137e9ead9001be2 openssh-7.3p1-x86_64-1_slack14.0.txz
Slackware 14.1 package:
6a2a5dca4d9334c70239c20bfed92791 openssh-7.3p1-i486-1_slack14.1.txz
Slackware x86_64 14.1 package:
eb14e40f2c50beb19ccf1aaccbaf416d openssh-7.3p1-x86_64-1_slack14.1.txz
Slackware 14.2 package:
624fbc40486642443292ffdaaffba640 openssh-7.3p1-i586-1_slack14.2.txz
Slackware x86_64 14.2 package:
c0e4d51dfb3722aa69e008389f4f089d openssh-7.3p1-x86_64-1_slack14.2.txz
Slackware -current package:
e9109896f7640f872e3695603579954f n/openssh-7.3p1-i586-1.txz
Slackware x86_64 -current package:
bcf65b51088b5b7f1dc55bab1ef63684 n/openssh-7.3p1-x86_64-1.txz
Installation instructions:
+------------------------+
Upgrade the package as root:
# upgradepkg openssh-7.3p1-i586-1_slack14.2.txz
Next, restart the sshd daemon:
# sh /etc/rc.d/rc.sshd restart
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key
security@xxxxxxxxxxxxx
+------------------------------------------------------------------------+
| To leave the slackware-security mailing list: |
+------------------------------------------------------------------------+
| Send an email to majordomo@xxxxxxxxxxxxx with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back containing instructions to |
| complete the process. Please do not reply to this email address. |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAlemPasACgkQakRjwEAQIjMfYgCfT1gdAwLhlKdLOv6TPhSmIN0S
gLIAnjkJiZkhcop4hEQ/1aVbFxUXB8Tx
=6xDu
-----END PGP SIGNATURE-----
