|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: openssh: GSSAPI info disclosure | ||
|---|---|---|---|
| Product: | [openSUSE] SUSE Linux 10.1 | Reporter: | Thomas Biege <thomas> |
| Component: | Other | Assignee: | Security Team bot <security-team> |
| Status: | RESOLVED FIXED | QA Contact: | E-mail List <qa-bugs> |
| Severity: | Normal | ||
| Priority: | P5 - None | CC: | ast, kukuk, patch-request, security-team |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| Whiteboard: | CVE-2005-2798: CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) | ||
| Found By: | Other | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
Thomas Biege
2005-10-18 06:43:36 UTC
Our default runtime configuration does not affected. This and other problems were discussed in bug #114964 and in comment 8 Marcus said : "We are also not planning to release security updates for the issues inside currently." But if you change the decision, I have small patch for this gssapi problem... ping can it switched on by the admin? if it can be switched on by the admin I tend to release an update for it Sorry for too late response, I was ill. Yes admin can enable it by set GSSAPIAuthentication to yes in /etc/ssh/sshd_config. Hope you are fine again! :) We should release updates for this bug. SSH is a sensible application and leaking credentials isn't good. I have prepared patch for all distros, but I have problem how I have to solve SLES9 distribution, because there is version update of openssh for SLES9-SP3 and it can collide with this security update. How can I solve? (prepare same update for SLES9 and SLES9-SP3?) i would suggest fix for the SP3 version only, it will obsolete the previous version anyway. Answer given by Marcus already ... Submited for all distros. Thorsten, where can I get the older patchinfo of openssh, which I submited with last changes for SLES9-SP3? I'd like update this patchinfo. This patchinfos are already checked in. If you wish to modify them, you have to ask hmuelle if this is still possible and how, I don't know. Harald, could you help me? Just submit your fixes as usual for an SP and sent the description extension by eMail to "maint-coord@suse.de" stating the MD5SUM, SWAMPID and SUBSWAMPID If we need more changes to the patchinfo, also sent an eMail telling the needed changes. Ok, and where I can get MD5SUM and SUBSWAMPID (I can't find it in swamp.suse.de, maybe I have not permission for SP3 SWAMPID). Thnx Zuzka (zpetrova@), which found the right record for me (b6dd9cd1ee5f739fa4bb7a65575aa18a, 2229, 2842). what is the status here? You have to ask security team. Thomas? its needinfo assigned to you? Dunno what info is left. As far as I can read from the previous entries packages are submitted, sles9 version problem ist solved, patchinfos are modified. status is ASSIGNED packages are submitted, but there is no patchinfo file, what's the status here ? see comment #12 an #13. I don't know what happens after it or if it happen at all. we need to supply new patchinfos for this bugfix (the comments talked about the SP3 patchinfo for the version update). So, we need patchinfos for all boxes (9.1-10.0), SLES8/SLEC. SLES 9 patchinfos are _not_ necessary, since we released the fix with SP3 already. Maintenance-Tracker-3418 /work/src/done/PATCHINFO/openssh.patch.maintained /work/src/done/PATCHINFO/openssh.patch.box packages approved CVE-2005-2798: CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) |