openssh (SSA:2008-095-01)

New openssh packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, and -current to fix a security issue.

More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1483

Here are the details from the Slackware 12.0 ChangeLog:
+--------------------------+
patches/packages/openssh-5.0p1-i486-1_slack12.0.tgz:
Upgraded to openssh-5.0p1.
This version fixes a security issue where local users could hijack forwarded
X connections. Upgrading to the new package is highly recommended.
For more information on this security issue, please see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1483
(* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

HINT: Getting slow download speeds from ftp.slackware.com?
Give slackware.osuosl.org a try. This is another primary FTP site
for Slackware that can be considerably faster than downloading
directly from ftp.slackware.com.

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating additional FTP and rsync hosting
to the Slackware project! :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 8.1:
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/openssh-5.0p1-i386-1_slack8.1.tgz

Updated package for Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/openssh-5.0p1-i386-1_slack9.0.tgz

Updated package for Slackware 9.1:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/openssh-5.0p1-i486-1_slack9.1.tgz

Updated package for Slackware 10.0:
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/openssh-5.0p1-i486-1_slack10.0.tgz

Updated package for Slackware 10.1:
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/openssh-5.0p1-i486-1_slack10.1.tgz

Updated package for Slackware 10.2:
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/openssh-5.0p1-i486-1_slack10.2.tgz

Updated package for Slackware 11.0:
ftp://ftp.slackware.com/pub/slackware/slackware-11.0/patches/packages/openssh-5.0p1-i486-1_slack11.0.tgz

Updated package for Slackware 12.0:
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/openssh-5.0p1-i486-1_slack12.0.tgz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/openssh-5.0p1-i486-1.tgz


MD5 signatures:
+-------------+

Slackware 8.1 package:
4a0e0f2293c98fd4ecb2049da7d6c0e7 openssh-5.0p1-i386-1_slack8.1.tgz

Slackware 9.0 package:
c3e5e085a32c916517badda0ade062d6 openssh-5.0p1-i386-1_slack9.0.tgz

Slackware 9.1 package:
375d94c11692403d4ee5b4b051a21610 openssh-5.0p1-i486-1_slack9.1.tgz

Slackware 10.0 package:
4aba1ec2f602618ffdcbde3b249fb05f openssh-5.0p1-i486-1_slack10.0.tgz

Slackware 10.1 package:
b0edcc0ef8a2de1a14c5492a04fdd931 openssh-5.0p1-i486-1_slack10.1.tgz

Slackware 10.2 package:
0335153a90308f17d83c0e3c24ccd9ee openssh-5.0p1-i486-1_slack10.2.tgz

Slackware 11.0 package:
e675ba53b97892063ea77b4dfa80dce9 openssh-5.0p1-i486-1_slack11.0.tgz

Slackware 12.0 package:
0712943ea51957cefa9c53d7f74f12e4 openssh-5.0p1-i486-1_slack12.0.tgz

Slackware -current package:
0d22d793f4ce2ab68e9a9b5e9b893e3c openssh-5.0p1-i486-1.tgz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg openssh-5.0p1-i486-1_slack12.0.tgz

IMPORTANT NOTE: Before restarting sshd (if you use it), be sure to move any new /etc/rc.d/rc.sshd into place:

mv /etc/rc.d/rc.sshd.new /etc/rc.d/rc.sshd

Then, make sure that the permissions are correct -- executable if you want sshd to start at boot, non-executable otherwise.

Finally, restart sshd:

sh /etc/rc.d/rc.sshd restart

This will restart the listener process so that all new connections to sshd will connect to the new sshd, while old connections will not be dropped (and may be insecure until they are disconnected and reattached). Any users who are forwarding X connections through ssh should drop their connection and log in again.

+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key