+------------------------------------------------------------------------+
| EnGarde Secure Linux Security Advisory                  March 07, 2002 |
|  http://www.engardelinux.org/ ESA-20020307-007 |
|                                                                        |
| Packages: openssh, openssh-clients, openssh-server                     |
| Summary:  Local vulnerability in OpenSSH's channel code.               |
+------------------------------------------------------------------------+

  EnGarde Secure Linux is a secure distribution of Linux that features
  improved access control, host and network intrusion detection, Web
  based secure remote management, complete e-commerce using AllCommerce,
  and integrated open source security tools.


OVERVIEW
--------
  There is a local vulnerability in the OpenSSH channel code which may
  allow a local, authenticated user to exploit the server.


DETAIL
------
  Joost Pol <joost@pine.nl> outlined this bug in Pine Internet Security
  Advisory PINE-CERT-20020301:

     http://www.pine.nl/advisories/pine-cert-20020301

"Users with an existing user account can abuse this bug to
     gain root privileges. Exploitability without an existing
     user account has not been proven but is not considered
     impossible. A malicious ssh server could also use this bug
     to exploit a connecting vulnerable client."

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has
  assigned the name CAN-2002-0083 to this issue.

     http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0083


SOLUTION
--------
  All users should upgrade to the most recent version as outlined in
  this advisory.

  Guardian Digital recently made available the Guardian Digital Secure
  Network, a means to proactively keep systems secure and manage
  system software. EnGarde users can automatically update their system
  using the Guardian Digital WebTool secure interface.

  If choosing to manually upgrade this package, updates can be
  obtained from:

     ftp://ftp.engardelinux.org/pub/engarde/stable/updates/
http://ftp.engardelinux.org/pub/engarde/stable/updates/

Before upgrading the package, the machine must either:

    a) be booted into a "standard" kernel; or
    b) have LIDS disabled.

  To disable LIDS, execute the command:

    # /sbin/lidsadm -S -- -LIDS_GLOBAL

  To install the updated package, execute the command:

    # rpm -Uvh 

You must now update the LIDS configuration by executing the command:

    # /usr/sbin/config_lids.pl

  To re-enable LIDS (if it was disabled), execute the command:

    # /sbin/lidsadm -S -- +LIDS_GLOBAL

  To verify the signatures of the updated packages, execute the command:

    # rpm -Kv 


UPDATED PACKAGES
----------------
  These updated packages are only for EnGarde Secure Linux Community
  Edition.

  Source Packages:

    SRPMS/openssh-2.3.0p1-1.0.18.src.rpm
      MD5 Sum: 675ca26dd4cf1bddb3363b65433a8833

  i386 Binary Packages:

    i386/openssh-2.3.0p1-1.0.18.i386.rpm
      MD5 Sum: 8564be9e0d904b29bbea0ce743e14f51

    i386/openssh-clients-2.3.0p1-1.0.18.i386.rpm
      MD5 Sum: a42d161a88ad830abec45a13b2ee710c

    i386/openssh-server-2.3.0p1-1.0.18.i386.rpm
      MD5 Sum: 77cf681f7b0e530d98ab784edec3a76f

  i686 Binary Packages:

    i686/openssh-2.3.0p1-1.0.18.i686.rpm
      MD5 Sum: a703f0046b35d7d08ee3a6354dde25ea

    i686/openssh-clients-2.3.0p1-1.0.18.i686.rpm
      MD5 Sum: e0e8de4271d26f36c75b28c727906bb4

    i686/openssh-server-2.3.0p1-1.0.18.i686.rpm
      MD5 Sum: 96d91d85f116934737bd3e1419bd90c0


REFERENCES
----------
  Guardian Digital's public key:
     http://ftp.engardelinux.org/pub/engarde/ENGARDE-GPG-KEY

Credit for the discovery of this bug goes to:
    Joost Pol <joost@pine.nl>

OpenSSH's Official Web Site:
     http://www.openssh.org/

Security Contact:    security@guardiandigital.com
EnGarde Advisories:   http://www.engardelinux.org/advisories.html

--------------------------------------------------------------------------
$Id: ESA-20020307-007-openssh,v 1.2 2002/03/07 16:27:48 rwm Exp $
--------------------------------------------------------------------------
Author: Ryan W. Maple, <ryan@guardiandigital.com>
Copyright 2002, Guardian Digital, Inc.