OpenPKG Security Advisory

Publisher Name:          OpenPKG GmbH
Publisher Home:          http://openpkg.com/

Advisory Id (public):    OpenPKG-SA-2003.042
Advisory Type:           OpenPKG Security Advisory (SA)
Advisory Directory:      http://openpkg.com/go/OpenPKG-SA
Advisory Document:       http://openpkg.com/go/OpenPKG-SA-2003.042
Advisory Published:      2008-11-21 23:01 UTC

Issue Id (internal):     OpenPKG-SI-20030924.01
Issue First Created:     2003-09-24
Issue Last Modified:     2006-11-28
Issue Revision:          08


Subject Name:            OpenSSH
Subject Summary:         Secure Shell (SSH)
Subject Home:            http://www.openssh.com/
Subject Versions:        * <= 3.7.1p1

Vulnerability Id:        CVE-2003-0786, CVE-2003-0787
Vulnerability Scope:     global (not OpenPKG specific)

Attack Feasibility:      run-time
Attack Vector:           remote network
Attack Impact:           privilege escalation

Description:
    According to a OpenSSH Security Advisory [0], versions 3.7p1 and
    3.7.1p1 of OpenSSH [1] contain multiple vulnerabilities in its
    Pluggable Authentication Modules (PAM) related code. At least one
    of these bugs is remotely exploitable if Privilege Separation is
    disabled and PAM support is enabled. Older versions of OpenSSH are not
    vulnerable. OpenPKG installations are only affected if the package was
    built with option "with_pam" set to "yes" -- which is not the default.
    
    CVE-2003-0786 refers to the problem where SSH1 PAM challenge
    response authentication ignored the result of the authentication with
    Privilege Separation off. CVE-2003-0787 refers to the problem where
    the PAM conversation function trashed the stack.

References:
    [0] http://www.openssh.com/txt/sshpam.adv
    [1] http://www.openssh.com/
    [2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0786
    [3] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0787
    [4] http://www.openpkg.org/tutorial.html#regular-source
    [5] http://www.openpkg.org/tutorial.html#regular-binary
    [6] ftp://ftp.openpkg.org/current/SRC/openssh-3.7.1p2-20030923.src.rpm
    [7] ftp://ftp.openpkg.org/current/SRC/


Primary Package Name:    openssh
Primary Package Home:    http://openpkg.org/go/package/openssh

Affected Distribution:   Affected Branch:  Affected Package:
OpenPKG Community        1.2-SOLID         n/a
OpenPKG Community        1.3-SOLID         n/a
OpenPKG Community        CURRENT           openssh-3.7.1p1-20030917

Corrected Distribution:  Corrected Branch: Corrected Package:
OpenPKG Community        1.2-SOLID         n/a
OpenPKG Community        1.3-SOLID         n/a
OpenPKG Community        CURRENT           openssh-3.7.1p2-20030923