Описание
Security update for openssh
This update for openssh fixes the following issues:
Security vulnerabilities addressed:
- CVE-2019-6109: Fixed an character encoding issue in the progress display of the scp client that could be used to manipulate client output, allowing for spoofing during file transfers (bsc#1121816).
- CVE-2019-6111: Properly validate object names received by the scp client to prevent arbitrary file overwrites when interacting with a malicious SSH server (bsc#1121821).
Other issues fixed:
- Fixed two race conditions in sshd relating to SIGHUP (bsc#1119183).
- Returned proper reason for port forwarding failures (bsc#1090671).
- Fixed a double free() in the KDF CAVS testing tool (bsc#1065237).
Список пакетов
SUSE Enterprise Storage 4
SUSE Linux Enterprise Desktop 12 SP3
SUSE Linux Enterprise Desktop 12 SP4
SUSE Linux Enterprise Server 12 SP2-BCL
SUSE Linux Enterprise Server 12 SP2-LTSS
SUSE Linux Enterprise Server 12 SP3
SUSE Linux Enterprise Server 12 SP4
SUSE Linux Enterprise Server for SAP Applications 12 SP2
SUSE Linux Enterprise Server for SAP Applications 12 SP3
SUSE Linux Enterprise Server for SAP Applications 12 SP4
SUSE OpenStack Cloud 7
Ссылки
- Link for SUSE-SU-2019:1524-1
- E-Mail link for SUSE-SU-2019:1524-1
- SUSE Security Ratings
- SUSE Bug 1065237
- SUSE Bug 1090671
- SUSE Bug 1119183
- SUSE Bug 1121816
- SUSE Bug 1121821
- SUSE Bug 1131709
- SUSE CVE CVE-2019-6109 page
- SUSE CVE CVE-2019-6111 page
Описание
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.
Затронутые продукты
Ссылки
- CVE-2019-6109
- SUSE Bug 1121571
- SUSE Bug 1121816
- SUSE Bug 1121818
- SUSE Bug 1121821
- SUSE Bug 1138392
- SUSE Bug 1144902
- SUSE Bug 1144903
- SUSE Bug 1148884
Описание
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).
Затронутые продукты
Ссылки
- CVE-2019-6111
- SUSE Bug 1121571
- SUSE Bug 1121816
- SUSE Bug 1121818
- SUSE Bug 1121821
- SUSE Bug 1123028
- SUSE Bug 1123220
- SUSE Bug 1131109
- SUSE Bug 1138392
- SUSE Bug 1144902
- SUSE Bug 1144903
- SUSE Bug 1148884
- SUSE Bug 1201840