1. Home
  2. Security Advisories
  3. SUSE
  4. SUSE-SU-2015:1695-1

[SUSE-SU-2015:1695-1] Security update for openssh

Severity Moderate
Affected Packages 26
CVEs 5
Info Packages References Vulnerabilities

Security update for openssh

OpenSSH was updated to fix several security issues and bugs.

Please note that due to a bug in the previous shipped openssh version, sshd might
not correctly restart. Please verify that the ssh daemon is running after installing
this update.

These security issues were fixed:

  • CVE-2015-5352: The x11_open_helper function, when ForwardX11Trusted mode
    is not used, lacked a check of the refusal deadline for X connections,
    which made it easier for remote attackers to bypass intended access
    restrictions via a connection outside of the permitted time window.
    (bsc#936695)

  • CVE-2015-5600: The kbdint_next_device function in auth2-chall.c
    in sshd did not properly restrict the processing of keyboard-interactive
    devices within a single connection, which made it easier for remote
    attackers to conduct brute-force attacks or cause a denial of service
    (CPU consumption) via a long and duplicative list in the ssh
    -oKbdInteractiveDevices option, as demonstrated by a modified client
    that provides a different password for each pam element on this list.
    (bsc#938746)

  • CVE-2015-4000: Removed and disabled weak DH groups to address LOGJAM.
    (bsc#932483)

  • Hardening patch to fix sftp RCE. (bsc#903649)

  • CVE-2015-6563: The monitor component in sshd accepted extraneous username
    data in MONITOR_REQ_PAM_INIT_CTX requests, which allowed local users to
    conduct impersonation attacks by leveraging any SSH login access in
    conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM
    request, related to monitor.c and monitor_wrap.c.

  • CVE-2015-6564: Use-after-free vulnerability in the mm_answer_pam_free_ctx
    function in monitor.c in sshd might have allowed local users to gain
    privileges by leveraging control of the sshd uid to send an unexpectedly
    early MONITOR_REQ_PAM_FREE_CTX request.

Additional a bug was fixed that could lead to openssh not working in
chroot (bsc#947458).

Package Affected Version
pkg:rpm/suse/openssh?arch=x86_64&distro=sles-11&sp=4 < 6.6p1-13.1
pkg:rpm/suse/openssh?arch=x86_64&distro=sled-11&sp=4 < 6.6p1-13.1
pkg:rpm/suse/openssh?arch=s390x&distro=sles-11&sp=4 < 6.6p1-13.1
pkg:rpm/suse/openssh?arch=ppc64&distro=sles-11&sp=4 < 6.6p1-13.1
pkg:rpm/suse/openssh?arch=ia64&distro=sles-11&sp=4 < 6.6p1-13.1
pkg:rpm/suse/openssh?arch=i586&distro=sles-11&sp=4 < 6.6p1-13.1
pkg:rpm/suse/openssh?arch=i586&distro=sled-11&sp=4 < 6.6p1-13.1
pkg:rpm/suse/openssh-helpers?arch=x86_64&distro=sles-11&sp=4 < 6.6p1-13.1
pkg:rpm/suse/openssh-helpers?arch=x86_64&distro=sled-11&sp=4 < 6.6p1-13.1
pkg:rpm/suse/openssh-helpers?arch=s390x&distro=sles-11&sp=4 < 6.6p1-13.1
pkg:rpm/suse/openssh-helpers?arch=ppc64&distro=sles-11&sp=4 < 6.6p1-13.1
pkg:rpm/suse/openssh-helpers?arch=ia64&distro=sles-11&sp=4 < 6.6p1-13.1
pkg:rpm/suse/openssh-helpers?arch=i586&distro=sles-11&sp=4 < 6.6p1-13.1
pkg:rpm/suse/openssh-helpers?arch=i586&distro=sled-11&sp=4 < 6.6p1-13.1
pkg:rpm/suse/openssh-fips?arch=x86_64&distro=sles-11&sp=4 < 6.6p1-13.1
pkg:rpm/suse/openssh-fips?arch=s390x&distro=sles-11&sp=4 < 6.6p1-13.1
pkg:rpm/suse/openssh-fips?arch=ppc64&distro=sles-11&sp=4 < 6.6p1-13.1
pkg:rpm/suse/openssh-fips?arch=ia64&distro=sles-11&sp=4 < 6.6p1-13.1
pkg:rpm/suse/openssh-fips?arch=i586&distro=sles-11&sp=4 < 6.6p1-13.1
pkg:rpm/suse/openssh-askpass-gnome?arch=x86_64&distro=sles-11&sp=4 < 6.6p1-13.3
pkg:rpm/suse/openssh-askpass-gnome?arch=x86_64&distro=sled-11&sp=4 < 6.6p1-13.3
pkg:rpm/suse/openssh-askpass-gnome?arch=s390x&distro=sles-11&sp=4 < 6.6p1-13.3
pkg:rpm/suse/openssh-askpass-gnome?arch=ppc64&distro=sles-11&sp=4 < 6.6p1-13.3
pkg:rpm/suse/openssh-askpass-gnome?arch=ia64&distro=sles-11&sp=4 < 6.6p1-13.3
pkg:rpm/suse/openssh-askpass-gnome?arch=i586&distro=sles-11&sp=4 < 6.6p1-13.3
pkg:rpm/suse/openssh-askpass-gnome?arch=i586&distro=sled-11&sp=4 < 6.6p1-13.3
ID
SUSE-SU-2015:1695-1
Severity
moderate
URL
https://www.suse.com/support/update/announcement/2015/suse-su-20151695-1/
Published
2015-10-05T16:22:28
(9 years ago)
Modified
2015-10-05T16:22:28
(9 years ago)
Rights
Copyright 2024 SUSE LLC. All rights reserved.
Other Advisories
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:rpm/suse/openssh?arch=x86_64&distro=sles-11&sp=4 suse openssh < 6.6p1-13.1 sles-11 x86_64
Affected pkg:rpm/suse/openssh?arch=x86_64&distro=sled-11&sp=4 suse openssh < 6.6p1-13.1 sled-11 x86_64
Affected pkg:rpm/suse/openssh?arch=s390x&distro=sles-11&sp=4 suse openssh < 6.6p1-13.1 sles-11 s390x
Affected pkg:rpm/suse/openssh?arch=ppc64&distro=sles-11&sp=4 suse openssh < 6.6p1-13.1 sles-11 ppc64
Affected pkg:rpm/suse/openssh?arch=ia64&distro=sles-11&sp=4 suse openssh < 6.6p1-13.1 sles-11 ia64
Affected pkg:rpm/suse/openssh?arch=i586&distro=sles-11&sp=4 suse openssh < 6.6p1-13.1 sles-11 i586
Affected pkg:rpm/suse/openssh?arch=i586&distro=sled-11&sp=4 suse openssh < 6.6p1-13.1 sled-11 i586
Affected pkg:rpm/suse/openssh-helpers?arch=x86_64&distro=sles-11&sp=4 suse openssh-helpers < 6.6p1-13.1 sles-11 x86_64
Affected pkg:rpm/suse/openssh-helpers?arch=x86_64&distro=sled-11&sp=4 suse openssh-helpers < 6.6p1-13.1 sled-11 x86_64
Affected pkg:rpm/suse/openssh-helpers?arch=s390x&distro=sles-11&sp=4 suse openssh-helpers < 6.6p1-13.1 sles-11 s390x
Affected pkg:rpm/suse/openssh-helpers?arch=ppc64&distro=sles-11&sp=4 suse openssh-helpers < 6.6p1-13.1 sles-11 ppc64
Affected pkg:rpm/suse/openssh-helpers?arch=ia64&distro=sles-11&sp=4 suse openssh-helpers < 6.6p1-13.1 sles-11 ia64
Affected pkg:rpm/suse/openssh-helpers?arch=i586&distro=sles-11&sp=4 suse openssh-helpers < 6.6p1-13.1 sles-11 i586
Affected pkg:rpm/suse/openssh-helpers?arch=i586&distro=sled-11&sp=4 suse openssh-helpers < 6.6p1-13.1 sled-11 i586
Affected pkg:rpm/suse/openssh-fips?arch=x86_64&distro=sles-11&sp=4 suse openssh-fips < 6.6p1-13.1 sles-11 x86_64
Affected pkg:rpm/suse/openssh-fips?arch=s390x&distro=sles-11&sp=4 suse openssh-fips < 6.6p1-13.1 sles-11 s390x
Affected pkg:rpm/suse/openssh-fips?arch=ppc64&distro=sles-11&sp=4 suse openssh-fips < 6.6p1-13.1 sles-11 ppc64
Affected pkg:rpm/suse/openssh-fips?arch=ia64&distro=sles-11&sp=4 suse openssh-fips < 6.6p1-13.1 sles-11 ia64
Affected pkg:rpm/suse/openssh-fips?arch=i586&distro=sles-11&sp=4 suse openssh-fips < 6.6p1-13.1 sles-11 i586
Affected pkg:rpm/suse/openssh-askpass-gnome?arch=x86_64&distro=sles-11&sp=4 suse openssh-askpass-gnome < 6.6p1-13.3 sles-11 x86_64
Affected pkg:rpm/suse/openssh-askpass-gnome?arch=x86_64&distro=sled-11&sp=4 suse openssh-askpass-gnome < 6.6p1-13.3 sled-11 x86_64
Affected pkg:rpm/suse/openssh-askpass-gnome?arch=s390x&distro=sles-11&sp=4 suse openssh-askpass-gnome < 6.6p1-13.3 sles-11 s390x
Affected pkg:rpm/suse/openssh-askpass-gnome?arch=ppc64&distro=sles-11&sp=4 suse openssh-askpass-gnome < 6.6p1-13.3 sles-11 ppc64
Affected pkg:rpm/suse/openssh-askpass-gnome?arch=ia64&distro=sles-11&sp=4 suse openssh-askpass-gnome < 6.6p1-13.3 sles-11 ia64
Affected pkg:rpm/suse/openssh-askpass-gnome?arch=i586&distro=sles-11&sp=4 suse openssh-askpass-gnome < 6.6p1-13.3 sles-11 i586
Affected pkg:rpm/suse/openssh-askpass-gnome?arch=i586&distro=sled-11&sp=4 suse openssh-askpass-gnome < 6.6p1-13.3 sled-11 i586
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date