Security update for openssh SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:1544-1 Final 1 1 2015-09-09T08:52:05Z current 2015-09-09T08:52:05Z 2015-09-09T08:52:05Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openssh openssh was updated to fix several security issues. These security issues were fixed: * CVE-2015-5352: The x11_open_helper function in channels.c in ssh in OpenSSH when ForwardX11Trusted mode is not used, lacked a check of the refusal deadline for X connections, which made it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time window (bsc#936695). * CVE-2015-5600: The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH did not properly restrict the processing of keyboard-interactive devices within a single connection, which made it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list (bsc#938746). * CVE-2015-4000: Removed and disabled weak DH groups to address LOGJAM (bsc#932483). * Hardening patch to fix sftp RCE (bsc#903649). * CVE-2015-6563: The monitor component in sshd in OpenSSH accepted extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which allowed local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c. (bsc#943010) * CVE-2015-6564: Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH might have allowed local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request. (bsc#943006) Also use %restart_on_update in the trigger script. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-2015-526,SUSE-SLE-SERVER-12-2015-526 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20151544-1/ Link for SUSE-SU-2015:1544-1 https://lists.suse.com/pipermail/sle-security-updates/2015-September/001589.html E-Mail link for SUSE-SU-2015:1544-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/903649 SUSE Bug 903649 https://bugzilla.suse.com/932483 SUSE Bug 932483 https://bugzilla.suse.com/936695 SUSE Bug 936695 https://bugzilla.suse.com/938746 SUSE Bug 938746 https://bugzilla.suse.com/943006 SUSE Bug 943006 https://bugzilla.suse.com/943010 SUSE Bug 943010 https://www.suse.com/security/cve/CVE-2015-4000/ SUSE CVE CVE-2015-4000 page https://www.suse.com/security/cve/CVE-2015-5352/ SUSE CVE CVE-2015-5352 page https://www.suse.com/security/cve/CVE-2015-5600/ SUSE CVE CVE-2015-5600 page https://www.suse.com/security/cve/CVE-2015-6563/ SUSE CVE CVE-2015-6563 page https://www.suse.com/security/cve/CVE-2015-6564/ SUSE CVE CVE-2015-6564 page SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server for SAP Applications 12 openssh-6.6p1-29.1 openssh-askpass-gnome-6.6p1-29.1 openssh-helpers-6.6p1-29.1 openssh-fips-6.6p1-29.1 openssh-6.6p1-29.1 as a component of SUSE Linux Enterprise Desktop 12 openssh-askpass-gnome-6.6p1-29.1 as a component of SUSE Linux Enterprise Desktop 12 openssh-helpers-6.6p1-29.1 as a component of SUSE Linux Enterprise Desktop 12 openssh-6.6p1-29.1 as a component of SUSE Linux Enterprise Server 12 openssh-askpass-gnome-6.6p1-29.1 as a component of SUSE Linux Enterprise Server 12 openssh-fips-6.6p1-29.1 as a component of SUSE Linux Enterprise Server 12 openssh-helpers-6.6p1-29.1 as a component of SUSE Linux Enterprise Server 12 openssh-6.6p1-29.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 openssh-askpass-gnome-6.6p1-29.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 openssh-fips-6.6p1-29.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 openssh-helpers-6.6p1-29.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue. CVE-2015-4000 SUSE Linux Enterprise Desktop 12:openssh-6.6p1-29.1 SUSE Linux Enterprise Desktop 12:openssh-askpass-gnome-6.6p1-29.1 SUSE Linux Enterprise Desktop 12:openssh-helpers-6.6p1-29.1 SUSE Linux Enterprise Server 12:openssh-6.6p1-29.1 SUSE Linux Enterprise Server 12:openssh-askpass-gnome-6.6p1-29.1 SUSE Linux Enterprise Server 12:openssh-fips-6.6p1-29.1 SUSE Linux Enterprise Server 12:openssh-helpers-6.6p1-29.1 SUSE Linux Enterprise Server for SAP Applications 12:openssh-6.6p1-29.1 SUSE Linux Enterprise Server for SAP Applications 12:openssh-askpass-gnome-6.6p1-29.1 SUSE Linux Enterprise Server for SAP Applications 12:openssh-fips-6.6p1-29.1 SUSE Linux Enterprise Server for SAP Applications 12:openssh-helpers-6.6p1-29.1 important 7.3 AV:N/AC:H/Au:N/C:C/I:C/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151544-1/ https://www.suse.com/security/cve/CVE-2015-4000.html CVE-2015-4000 https://bugzilla.suse.com/1074631 SUSE Bug 1074631 https://bugzilla.suse.com/1211968 SUSE Bug 1211968 https://bugzilla.suse.com/931600 SUSE Bug 931600 https://bugzilla.suse.com/931698 SUSE Bug 931698 https://bugzilla.suse.com/931723 SUSE Bug 931723 https://bugzilla.suse.com/931845 SUSE Bug 931845 https://bugzilla.suse.com/932026 SUSE Bug 932026 https://bugzilla.suse.com/932483 SUSE Bug 932483 https://bugzilla.suse.com/934789 SUSE Bug 934789 https://bugzilla.suse.com/935033 SUSE Bug 935033 https://bugzilla.suse.com/935540 SUSE Bug 935540 https://bugzilla.suse.com/935979 SUSE Bug 935979 https://bugzilla.suse.com/937202 SUSE Bug 937202 https://bugzilla.suse.com/937766 SUSE Bug 937766 https://bugzilla.suse.com/938248 SUSE Bug 938248 https://bugzilla.suse.com/938432 SUSE Bug 938432 https://bugzilla.suse.com/938895 SUSE Bug 938895 https://bugzilla.suse.com/938905 SUSE Bug 938905 https://bugzilla.suse.com/938906 SUSE Bug 938906 https://bugzilla.suse.com/938913 SUSE Bug 938913 https://bugzilla.suse.com/938945 SUSE Bug 938945 https://bugzilla.suse.com/943664 SUSE Bug 943664 https://bugzilla.suse.com/944729 SUSE Bug 944729 https://bugzilla.suse.com/945582 SUSE Bug 945582 https://bugzilla.suse.com/955589 SUSE Bug 955589 https://bugzilla.suse.com/980406 SUSE Bug 980406 https://bugzilla.suse.com/990592 SUSE Bug 990592 https://bugzilla.suse.com/994144 SUSE Bug 994144 The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time window. CVE-2015-5352 SUSE Linux Enterprise Desktop 12:openssh-6.6p1-29.1 SUSE Linux Enterprise Desktop 12:openssh-askpass-gnome-6.6p1-29.1 SUSE Linux Enterprise Desktop 12:openssh-helpers-6.6p1-29.1 SUSE Linux Enterprise Server 12:openssh-6.6p1-29.1 SUSE Linux Enterprise Server 12:openssh-askpass-gnome-6.6p1-29.1 SUSE Linux Enterprise Server 12:openssh-fips-6.6p1-29.1 SUSE Linux Enterprise Server 12:openssh-helpers-6.6p1-29.1 SUSE Linux Enterprise Server for SAP Applications 12:openssh-6.6p1-29.1 SUSE Linux Enterprise Server for SAP Applications 12:openssh-askpass-gnome-6.6p1-29.1 SUSE Linux Enterprise Server for SAP Applications 12:openssh-fips-6.6p1-29.1 SUSE Linux Enterprise Server for SAP Applications 12:openssh-helpers-6.6p1-29.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151544-1/ https://www.suse.com/security/cve/CVE-2015-5352.html CVE-2015-5352 https://bugzilla.suse.com/1074631 SUSE Bug 1074631 https://bugzilla.suse.com/1138392 SUSE Bug 1138392 https://bugzilla.suse.com/936695 SUSE Bug 936695 https://bugzilla.suse.com/938277 SUSE Bug 938277 https://bugzilla.suse.com/948086 SUSE Bug 948086 https://bugzilla.suse.com/992991 SUSE Bug 992991 https://bugzilla.suse.com/996040 SUSE Bug 996040 The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list. CVE-2015-5600 SUSE Linux Enterprise Desktop 12:openssh-6.6p1-29.1 SUSE Linux Enterprise Desktop 12:openssh-askpass-gnome-6.6p1-29.1 SUSE Linux Enterprise Desktop 12:openssh-helpers-6.6p1-29.1 SUSE Linux Enterprise Server 12:openssh-6.6p1-29.1 SUSE Linux Enterprise Server 12:openssh-askpass-gnome-6.6p1-29.1 SUSE Linux Enterprise Server 12:openssh-fips-6.6p1-29.1 SUSE Linux Enterprise Server 12:openssh-helpers-6.6p1-29.1 SUSE Linux Enterprise Server for SAP Applications 12:openssh-6.6p1-29.1 SUSE Linux Enterprise Server for SAP Applications 12:openssh-askpass-gnome-6.6p1-29.1 SUSE Linux Enterprise Server for SAP Applications 12:openssh-fips-6.6p1-29.1 SUSE Linux Enterprise Server for SAP Applications 12:openssh-helpers-6.6p1-29.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151544-1/ https://www.suse.com/security/cve/CVE-2015-5600.html CVE-2015-5600 https://bugzilla.suse.com/1009988 SUSE Bug 1009988 https://bugzilla.suse.com/1074631 SUSE Bug 1074631 https://bugzilla.suse.com/1138392 SUSE Bug 1138392 https://bugzilla.suse.com/938746 SUSE Bug 938746 https://bugzilla.suse.com/943006 SUSE Bug 943006 https://bugzilla.suse.com/943007 SUSE Bug 943007 https://bugzilla.suse.com/943010 SUSE Bug 943010 https://bugzilla.suse.com/943504 SUSE Bug 943504 https://bugzilla.suse.com/945985 SUSE Bug 945985 https://bugzilla.suse.com/948086 SUSE Bug 948086 https://bugzilla.suse.com/954457 SUSE Bug 954457 https://bugzilla.suse.com/957883 SUSE Bug 957883 https://bugzilla.suse.com/996040 SUSE Bug 996040 The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which allows local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c. CVE-2015-6563 SUSE Linux Enterprise Desktop 12:openssh-6.6p1-29.1 SUSE Linux Enterprise Desktop 12:openssh-askpass-gnome-6.6p1-29.1 SUSE Linux Enterprise Desktop 12:openssh-helpers-6.6p1-29.1 SUSE Linux Enterprise Server 12:openssh-6.6p1-29.1 SUSE Linux Enterprise Server 12:openssh-askpass-gnome-6.6p1-29.1 SUSE Linux Enterprise Server 12:openssh-fips-6.6p1-29.1 SUSE Linux Enterprise Server 12:openssh-helpers-6.6p1-29.1 SUSE Linux Enterprise Server for SAP Applications 12:openssh-6.6p1-29.1 SUSE Linux Enterprise Server for SAP Applications 12:openssh-askpass-gnome-6.6p1-29.1 SUSE Linux Enterprise Server for SAP Applications 12:openssh-fips-6.6p1-29.1 SUSE Linux Enterprise Server for SAP Applications 12:openssh-helpers-6.6p1-29.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151544-1/ https://www.suse.com/security/cve/CVE-2015-6563.html CVE-2015-6563 https://bugzilla.suse.com/1074631 SUSE Bug 1074631 https://bugzilla.suse.com/943006 SUSE Bug 943006 https://bugzilla.suse.com/943007 SUSE Bug 943007 https://bugzilla.suse.com/943010 SUSE Bug 943010 https://bugzilla.suse.com/948086 SUSE Bug 948086 https://bugzilla.suse.com/996040 SUSE Bug 996040 Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-OpenBSD platforms might allow local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request. CVE-2015-6564 SUSE Linux Enterprise Desktop 12:openssh-6.6p1-29.1 SUSE Linux Enterprise Desktop 12:openssh-askpass-gnome-6.6p1-29.1 SUSE Linux Enterprise Desktop 12:openssh-helpers-6.6p1-29.1 SUSE Linux Enterprise Server 12:openssh-6.6p1-29.1 SUSE Linux Enterprise Server 12:openssh-askpass-gnome-6.6p1-29.1 SUSE Linux Enterprise Server 12:openssh-fips-6.6p1-29.1 SUSE Linux Enterprise Server 12:openssh-helpers-6.6p1-29.1 SUSE Linux Enterprise Server for SAP Applications 12:openssh-6.6p1-29.1 SUSE Linux Enterprise Server for SAP Applications 12:openssh-askpass-gnome-6.6p1-29.1 SUSE Linux Enterprise Server for SAP Applications 12:openssh-fips-6.6p1-29.1 SUSE Linux Enterprise Server for SAP Applications 12:openssh-helpers-6.6p1-29.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151544-1/ https://www.suse.com/security/cve/CVE-2015-6564.html CVE-2015-6564 https://bugzilla.suse.com/1074631 SUSE Bug 1074631 https://bugzilla.suse.com/1138392 SUSE Bug 1138392 https://bugzilla.suse.com/942850 SUSE Bug 942850 https://bugzilla.suse.com/943006 SUSE Bug 943006 https://bugzilla.suse.com/943007 SUSE Bug 943007 https://bugzilla.suse.com/943010 SUSE Bug 943010 https://bugzilla.suse.com/948086 SUSE Bug 948086 https://bugzilla.suse.com/996040 SUSE Bug 996040