Security Information / 2002 / Security Information -- DSA-119-1 ssh

Debian Security Advisory

DSA-119-1 ssh -- local root exploit, remote client exploit

Date Reported:

07 Mar 2002

Affected Packages:

ssh

Vulnerable:

No

Security database references:

In the Bugtraq database (at SecurityFocus): BugTraq ID 4241.
In Mitre's CVE dictionary: CVE-2002-0083.

More information:

Joost Pol reports that OpenSSH versions 2.0 through 3.0.2 have an off-by-one bug in the channel allocation code. This vulnerability can be exploited by authenticated users to gain root privilege or by a malicious server exploiting a client with this bug.

Since Debian 2.2 (potato) shipped with OpenSSH (the "ssh" package) version 1.2.3, it is not vulnerable to this exploit. No fix is required for Debian 2.2 (potato).

The Debian unstable and testing archives do include a more recent OpenSSH (ssh) package. If you are running these pre-release distributions you should ensure that you are running version 3.0.2p1-8, a patched version which was added to the unstable archive today, or a later version.