openssh-6.6.1p1-23.el7

エラータID: AXSA:2016-037:01

Release date: 
Friday, January 15, 2016 - 04:52
Subject: 
openssh-6.6.1p1-23.el7
Affected Channels: 
Asianux Server 7 for x86_64
Severity: 
Moderate
Description: 

SSH (Secure SHell) is a program for logging into and executing
commands on a remote machine. SSH is intended to replace rlogin and
rsh, and to provide secure encrypted communications between two
untrusted hosts over an insecure network. X11 connections and
arbitrary TCP/IP ports can also be forwarded over the secure channel.

OpenSSH is OpenBSD's version of the last free version of SSH, bringing
it up to date in terms of security and features.

This package includes the core files necessary for both the OpenSSH
client and server. To make this package useful, you should also
install openssh-clients, openssh-server, or both.

Security issues fixed with this release:

CVE-2016-0777
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be
provided.
CVE-2016-0778
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be
provided.

Solution: 

Update packages.

CVEs: 
CVE-2016-0777
The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key.
CVE-2016-0778
The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings.
Additional Info: 

N/A

Download: 

SRPMS
  1. openssh-6.6.1p1-23.el7.src.rpm
    MD5: 1665a65ec76cf46b261ef7bafc03f195
    SHA-256: b71cd82f1998ad8ccfe243581d8a1f55b5ad466eb03ab181956f6aefd26b1e20
    Size: 1.70 MB

Asianux Server 7 for x86_64
  1. openssh-6.6.1p1-23.el7.x86_64.rpm
    MD5: 8263a05723d1086931f6ee457c5b3e1f
    SHA-256: 231acb2787a52915e4673c0358214e712f5337098c4ed1da941deb057d1409bf
    Size: 433.78 kB
  2. openssh-askpass-6.6.1p1-23.el7.x86_64.rpm
    MD5: fa2993d9cabee942f94435fe517924c5
    SHA-256: ee31235326c0bce454d4f3d42ff4fabc5052d37094980ae8ec8f5cf35545b5e4
    Size: 70.70 kB
  3. openssh-clients-6.6.1p1-23.el7.x86_64.rpm
    MD5: 66167b669d78878201c5c1091c41cad0
    SHA-256: 8d63b6fce9af2cd7512b7a6ac6759d3289d40272aec3e4c55fff568e3a6312c4
    Size: 637.82 kB
  4. openssh-keycat-6.6.1p1-23.el7.x86_64.rpm
    MD5: 887c7e3f97038b37514aa8edd0a88080
    SHA-256: 18a55d01e2b1c62b8b7e126d9e58720c10387f88ae965bff06ec7dd39f370aa5
    Size: 85.14 kB
  5. openssh-server-6.6.1p1-23.el7.x86_64.rpm
    MD5: cce7e996689d20725cd5291853fe6712
    SHA-256: ed7d035be8229cd73d5a2625289b52e484080db453a8cc6d464fb95857bfd79a
    Size: 435.00 kB