Mandrake: ‘openssh’ Privilege escalation vulnerability

Mandrake: “The new OpenSSH 3.0.2 fixes a vulnerability in the UseLogin option.
By default, Mandrake Linux does not enable UseLogin, but if the
administrator enables it, local users are able to pass environment
variables to the login process. This update also fixes a security
hole in the KerberosV support that is present in versions 2.9.9 and
3.0.0.”

________________________________________________________________________

                Mandrake Linux Security Update Advisory
________________________________________________________________________

Package name:           openssh
Date:                   December 13th, 2001
Advisory ID:            MDKSA-2001:092

Affected versions:      7.1, 7.2, 8.0, 8.1, Corporate Server 1.0.1,
                        Single Network Firewall 7.2
________________________________________________________________________

Problem Description:

 The new OpenSSH 3.0.2 fixes a vulnerability in the UseLogin option.
 By default, Mandrake Linux does not enable UseLogin, but if the
 administrator enables it, local users are able to pass environment
 variables to the login process.  This update also fixes a security
 hole in the KerberosV support that is present in versions 2.9.9 and
 3.0.0.
________________________________________________________________________

References:

   http://www.kb.cert.org/vuls/id/157447http://www.securityfocus.com/bid/3614
________________________________________________________________________

Please verify the update prior to upgrading to ensure the integrity of
the downloaded package.  You can do this with the command:

  rpm --checksig package.rpm

You can get the GPG public key of the Mandrake Linux Security Team at:

  https://www.mandrakesecure.net/RPM-GPG-KEYS

If you use MandrakeUpdate, the verification of md5 checksum and GPG
signature is performed automatically for you.

Linux-Mandrake 7.1:
e0079727f3b224c0117abb67d7612ff5  7.1/RPMS/openssh-3.0.2p1-1.4mdk.i586.rpm
3ef16734c76cc748fa4c4c8bffdf590a  7.1/RPMS/openssh-askpass-3.0.2p1-1.4mdk.i586.rpm
7fe525cf07d54c08a27e68d427aed54e  7.1/RPMS/openssh-askpass-gnome-3.0.2p1-1.4mdk.i586.rpm
a9af9ccb91c68494ec5b2b77c8cf73f1  7.1/RPMS/openssh-clients-3.0.2p1-1.4mdk.i586.rpm
d0361bbc9055f065f0b3f0811f41bbbc  7.1/RPMS/openssh-server-3.0.2p1-1.4mdk.i586.rpm
414df2648031fc5d54500033788841a2  7.1/SRPMS/openssh-3.0.2p1-1.4mdk.src.rpm

Linux-Mandrake 7.2:
1b285e4e13afc20c45c3aefe21b670de  7.2/RPMS/openssh-3.0.2p1-1.3mdk.i586.rpm
30163d91b9a1cb2e5bb45eaa33a49e82  7.2/RPMS/openssh-askpass-3.0.2p1-1.3mdk.i586.rpm
5f69e40f1b55c27ae886163f11cef22e  7.2/RPMS/openssh-askpass-gnome-3.0.2p1-1.3mdk.i586.rpm
8071c22fa390f71d04a006b999bec9ea  7.2/RPMS/openssh-clients-3.0.2p1-1.3mdk.i586.rpm
dca2792c25c578c90609aa4354c93446  7.2/RPMS/openssh-server-3.0.2p1-1.3mdk.i586.rpm
f5322a10004f01ff3e980665b06b0c2c  7.2/SRPMS/openssh-3.0.2p1-1.3mdk.src.rpm

Mandrake Linux 8.0:
92583a96e61c68e584ecca0a99fea49a  8.0/RPMS/openssh-3.0.2p1-1.2mdk.i586.rpm
e5a08d157ddacb87ad5dd33a86cdfacc  8.0/RPMS/openssh-askpass-3.0.2p1-1.2mdk.i586.rpm
7c762c77e164e801f69120bdc64dd9c6  8.0/RPMS/openssh-askpass-gnome-3.0.2p1-1.2mdk.i586.rpm
94d89e26bf4c06b51a1690f84e3a22c9  8.0/RPMS/openssh-clients-3.0.2p1-1.2mdk.i586.rpm
dd003cb8c830834042639a02e873e0cd  8.0/RPMS/openssh-server-3.0.2p1-1.2mdk.i586.rpm
e7a00228e5ce33f4fa2fdb3ae81b6193  8.0/SRPMS/openssh-3.0.2p1-1.2mdk.src.rpm

Mandrake Linux 8.0 (PPC):
21cd5bdb543a85107ac8053ee61ce53d  ppc/8.0/RPMS/openssh-3.0.2p1-1.2mdk.ppc.rpm
23d6f681b9d35f447dd22a7ce5d7379c  ppc/8.0/RPMS/openssh-askpass-3.0.2p1-1.2mdk.ppc.rpm
9783d529166d906ec756720a93931397  ppc/8.0/RPMS/openssh-askpass-gnome-3.0.2p1-1.2mdk.ppc.rpm
6df6e5e55ae389cd67a9396fa24051bd  ppc/8.0/RPMS/openssh-clients-3.0.2p1-1.2mdk.ppc.rpm
51cc4e399b4d34a4b2362567e50d3af8  ppc/8.0/RPMS/openssh-server-3.0.2p1-1.2mdk.ppc.rpm
e7a00228e5ce33f4fa2fdb3ae81b6193  ppc/8.0/SRPMS/openssh-3.0.2p1-1.2mdk.src.rpm

Mandrake Linux 8.1:
03c865f75376983ee5cf916b97f247a0  8.1/RPMS/openssh-3.0.2p1-1.1mdk.i586.rpm
7e6f0f843162b01dcdcf8fb6879d7b3a  8.1/RPMS/openssh-askpass-3.0.2p1-1.1mdk.i586.rpm
d5d324cb252c797c842120a4beaf6999  8.1/RPMS/openssh-askpass-gnome-3.0.2p1-1.1mdk.i586.rpm
82249844e9403fb9b5167ef2206f92fa  8.1/RPMS/openssh-clients-3.0.2p1-1.1mdk.i586.rpm
565c208ce7a45c95b0f5603041cf81de  8.1/RPMS/openssh-server-3.0.2p1-1.1mdk.i586.rpm
b53afe42d601722309c32b2703ce17cc  8.1/SRPMS/openssh-3.0.2p1-1.1mdk.src.rpm

Mandrake Linux 8.1 (IA64):
a8412c4261d801342c0f2f8d03ebc9f1  ia64/8.1/RPMS/openssh-3.0.2p1-1.1mdk.ia64.rpm
3d950bcee8d4feb5be3610ca69a51017  ia64/8.1/RPMS/openssh-askpass-3.0.2p1-1.1mdk.ia64.rpm
15aafe7d7b1e99733744d75c34936650  ia64/8.1/RPMS/openssh-askpass-gnome-3.0.2p1-1.1mdk.ia64.rpm
8e40f604a20f5e190b6bfdef2802f31a  ia64/8.1/RPMS/openssh-clients-3.0.2p1-1.1mdk.ia64.rpm
8f7e2ae1299279f68b6e490900511dd4  ia64/8.1/RPMS/openssh-server-3.0.2p1-1.1mdk.ia64.rpm
b53afe42d601722309c32b2703ce17cc  ia64/8.1/SRPMS/openssh-3.0.2p1-1.1mdk.src.rpm

Corporate Server 1.0.1:
e0079727f3b224c0117abb67d7612ff5  1.0.1/RPMS/openssh-3.0.2p1-1.4mdk.i586.rpm
3ef16734c76cc748fa4c4c8bffdf590a  1.0.1/RPMS/openssh-askpass-3.0.2p1-1.4mdk.i586.rpm
7fe525cf07d54c08a27e68d427aed54e  1.0.1/RPMS/openssh-askpass-gnome-3.0.2p1-1.4mdk.i586.rpm
a9af9ccb91c68494ec5b2b77c8cf73f1  1.0.1/RPMS/openssh-clients-3.0.2p1-1.4mdk.i586.rpm
d0361bbc9055f065f0b3f0811f41bbbc  1.0.1/RPMS/openssh-server-3.0.2p1-1.4mdk.i586.rpm
414df2648031fc5d54500033788841a2  1.0.1/SRPMS/openssh-3.0.2p1-1.4mdk.src.rpm

Single Network Firewall 7.2:
1b285e4e13afc20c45c3aefe21b670de  snf7.2/RPMS/openssh-3.0.2p1-1.3mdk.i586.rpm
30163d91b9a1cb2e5bb45eaa33a49e82  snf7.2/RPMS/openssh-askpass-3.0.2p1-1.3mdk.i586.rpm
5f69e40f1b55c27ae886163f11cef22e  snf7.2/RPMS/openssh-askpass-gnome-3.0.2p1-1.3mdk.i586.rpm
8071c22fa390f71d04a006b999bec9ea  snf7.2/RPMS/openssh-clients-3.0.2p1-1.3mdk.i586.rpm
dca2792c25c578c90609aa4354c93446  snf7.2/RPMS/openssh-server-3.0.2p1-1.3mdk.i586.rpm
f5322a10004f01ff3e980665b06b0c2c  snf7.2/SRPMS/openssh-3.0.2p1-1.3mdk.src.rpm
________________________________________________________________________

Bug IDs fixed (see https://qa.mandrakesoft.com for more information):

________________________________________________________________________

Before applying this update, make sure all previously released updates
relevant to your system have been applied.  To upgrade automatically,
use MandrakeUpdate.

If you want to upgrade manually, download the updated package from one
of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm".

You can download the updates directly from one of the mirror sites
listed at:

   http://www.linux-mandrake.com/en/ftp.php3.

Updated packages are available in the "updates/[ver]/RPMS/" directory.
For example, if you are looking for an updated RPM package for
Mandrake Linux 8.1, look for it in "updates/8.1/RPMS/".  Updated source
RPMs are available as well, but you generally do not need to download
them.

Please be aware that sometimes it takes the mirrors a few hours to
update.

You can view other security advisories for Mandrake Linux at:

   http://www.linux-mandrake.com/en/security/

If you want to report vulnerabilities, please contact

  security@linux-mandrake.com
________________________________________________________________________

Mandrake Linux has several security-related mailing list services that
anyone can subscribe to.  Information on these lists can be obtained by
visiting:

   http://www.mandrakesecure.net/en/mlist.php
________________________________________________________________________

Type Bits/KeyID     Date       User ID
pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  security@linux-mandrake.com>


-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.5 (GNU/Linux)
Comment: For info see  http://www.gnupg.org

mQGiBDlp594RBAC2tDozI3ZgQsE7XwxurJCJrX0L5vx7SDByR5GHDdWekGhdiday
L4nfUax+SeR9SCoCgTgPW1xB8vtQc8/sinJlMjp9197a2iKM0FOcPlkpa3HcOdt7
WKJqQhlMrHvRcsivzcgqjH44GBBJIT6sygUF8k0lU6YnMHj5MPc/NGWt8wCg9vKo
P0l5QVAFSsHtqcU9W8cc7wMEAJzQsAlnvPXDBfBLEH6u7ptWFdp0GvbSuG2wRaPl
hynHvRiE01ZvwbJZXsPsKm1z7uVoW+NknKLunWKB5axrNXDHxCYJBzY3jTeFjsqx
PFZkIEAQphLTkeXXelAjQ5u9tEshPswEtMvJvUgNiAfbzHfPYmq8D6x5xOw1IySg
2e/LBACxr2UJYCCB2BZ3p508mAB0RpuLGukq+7UWiOizy+kSskIBg2O7sQkVY/Cs
iyGEo4XvXqZFMY39RBdfm2GY+WB/5NFiTOYJRKjfprP6K1YbtsmctsX8dG+foKsD
LLFs7OuVfaydLQYp1iiN6D+LJDSMPM8/LCWzZsgr9EKJ8NXiyrQ6TGludXggTWFu
ZHJha2UgU2VjdXJpdHkgVGVhbSA8c2VjdXJpdHlAbGludXgtbWFuZHJha2UuY29t
PohWBBMRAgAWBQI5aefeBAsKBAMDFQMCAxYCAQIXgAAKCRCaqNDQIkWKmK6LAKCy
/NInDsaMSI+WHwrquwC5PZrcnQCeI+v3gUDsNfQfiKBvQSANu1hdulqIRgQQEQIA
BgUCOtNVGQAKCRBZ5w3um0pAJJWQAKDUoL5He+mKbfrMaTuyU5lmRyJ0fwCgoFAP
WdvQlu/kFjphF740XeOwtOqIRgQQEQIABgUCOu8A6QAKCRBynDnb9lq3CnpjAJ4w
Pk0SEE9U4r40IxWpwLU+wrWVugCdFfSPllPpZRCiaC7HwbFcfExRmPa5AQ0EOWnn
7xAEAOQlTVY4TiNo5V/iP0J1xnqjqlqZsU7yEBKo/gZz6/+hx75RURe1ebiJ9F77
9FQbpJ9Epz1KLSXvq974rnVb813zuGdmgFyk+ryA/rTR2RQ8h+EoNkwmATzRxBXV
Jb57fFQjxOu4eNjZAtfII/YXb0uyXXrdr5dlJ/3eXrcO4p0XAAMFBACCxo6Z269s
+A4v8C6Ui12aarOQcCDlV8cVG9LkyatU3FNTlnasqwo6EkaP572448weJWwN6SCX
Vl+xOYLiK0hL/6Jb/O9Agw75yUVdk+RMM2I4fNEi+y4hmfMh2siBv8yEkEvZjTcl
3TpkTfzYky85tu433wmKaLFOv0WjBFSikohGBBgRAgAGBQI5aefvAAoJEJqo0NAi
RYqYid0AoJgeWzXrEdIClBOSW5Q6FzqJJyaqAKC0Y9YI3UFlE4zSIGjcFlLJEJGX
lA==
=0ahQ
-----END PGP PUBLIC KEY BLOCK-----