Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2016:2339-1

Опубликовано: 19 сент. 2016
Источник: suse-cvrf

Описание

Security update for openssh

This update for openssh fixes the following issues:

  • Prevent user enumeration through the timing of password processing (bsc#989363, CVE-2016-6210)
  • Allow lowering the DH groups parameter limit in server as well as when GSSAPI key exchange is used (bsc#948902)
  • limit accepted password length (prevents possible DoS) (bsc#992533, CVE-2016-6515)

Bug fixes:

  • avoid complaining about unset DISPLAY variable (bsc#981654)

This update was imported from the SUSE:SLE-12:Update update project.

Список пакетов

openSUSE Leap 42.1
openssh-6.6p1-14.1
openssh-askpass-gnome-6.6p1-14.1
openssh-cavs-6.6p1-14.1
openssh-fips-6.6p1-14.1
openssh-helpers-6.6p1-14.1

Ссылки

Описание

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.

Затронутые продукты
openSUSE Leap 42.1:openssh-6.6p1-14.1
openSUSE Leap 42.1:openssh-askpass-gnome-6.6p1-14.1
openSUSE Leap 42.1:openssh-cavs-6.6p1-14.1
openSUSE Leap 42.1:openssh-fips-6.6p1-14.1
Ссылки

Описание

The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.

Затронутые продукты
openSUSE Leap 42.1:openssh-6.6p1-14.1
openSUSE Leap 42.1:openssh-askpass-gnome-6.6p1-14.1
openSUSE Leap 42.1:openssh-cavs-6.6p1-14.1
openSUSE Leap 42.1:openssh-fips-6.6p1-14.1
Ссылки
Уязвимость openSUSE-SU-2016:2339-1