ngCERT - Nigerian Computer Emergency Response Team-ALERT AND WARNING UNIT
Security Advisory Vulnerability

Severity: High

OpenSSH Client Vulnerability


OpenSSH Client Vulnerability
Severity: High

Advisory ID: ngCERT-2016-0002
Version: 1.00
Probability: high
CVE ID:
CCVE-2016-0777, CVE-2016-0778

Damage:

high

Publication Date: 18-Jan-2016
Product(s): OpenBSD OpenSSH
Plateform(s):

Canonical Ubuntu Linux
Debian GNU/Linux
FreeBSD 0.4_1
OpenBSD 2.0
Redhat Red Hat desktop

Summary: OpenSSH version 7.1p2 has been released to address vulnerabilities in versions 5.4 through 7.1p1. Exploitation of one of these vulnerabilities may allow a remote attacker to obtain sensitive information from an affected system.
Consequences: data theft
Description:

The OpenSSH client code between 5.4 and 7.1 contains experimental support for resuming SSH-connections (roaming).

The matching server code has never been shipped, but the client code was enabled by default and could be tricked by a malicious server into leaking client memory to the server, including private client user keys.

The authentication of the server host key prevents exploitation by a man-in-the-middle, so this information leak is restricted to connections to malicious or compromised servers.

It should be noted that a successful exploit requires the attacker to trick the target computer into connecting to a malicious server, which limits the scope for exploit. “The authentication of the server host key prevents exploitation by a man-in-the-middle, so this information leak is restricted to connections to malicious or compromised servers,” the OpenSSH statement said.

Solution:

ngCERT Advises users to update their Openssh applications to OpenSSH version 7.1p2.

ngERT Advises daily update of your Linux system through the Update Manager (GUI tool)or using the command like so:


1. Open up a terminal window.
2. Issue the command

for Debian:
#apt-get update
#apt-get upgrade

for rpm based systems eg Redhat:
#yum update

for slackware based systems:
# slackpkg update gpg
# slackpkg update

for Gentoo releses:
#emerge—sync
#emerge -uDav—tree world
#emerge -av—depclean
#revdep-rebuild -v——ask
#dispatch-conf
#glsa-check -t all
#glsa-check -f all

for pacman based systems:
#pacman -Syu

3. Look over the list of available updates and decide if you want to go through with the entire upgrade.
4. To accept all updates click the ‘y’ key (no quotes) and hit Enter. ( if required)

Watch as the update happens.
That’s it. Your system is now up to date

Note(debian): If you would prefer to have updates applied automatically, make sure the unattended-upgrades package is installed, then run ‘sudo dpkg-reconfigure unattended-upgrades’.
Please note that updates may restart services on your server, so this may not be appropriate for all environments.

Hyperlinks:

http://www.symantec.com/connect/blogs/new-openssh-bug-could-leak-encryption-keys-attackers

https://www.debian.org/security/2016/dsa-3446

http://www.ubuntu.com/usn/usn-2869-1/

http://www.us-cert.gov/ncas/current-activity/2016/01/14/OpenSSH-Client-Vulnerability

http://www.openssh.com/txt/release-7.1p2


image
Security Alert

& Advisory

Read More image
image
We Love to

Hear From You

Send Your Enquiry Here image
Join Our Newsletter