GLSA 201911-01: OpenSSH: Integer overflow

http://security.gentoo.org/

Severity:	normal
Title:	OpenSSH: Integer overflow
Date:	11/07/2019
Bugs:	#697046
ID:	201911-01

Synopsis

An integer overflow in OpenSSH might allow an attacker to execute arbitrary code.

Background

OpenSSH is a complete SSH protocol implementation that includes SFTP client and server support.

Affected packages

Package	Vulnerable	Unaffected	Architecture(s)
net-misc/openssh	>= 8.0_p1-r2	>= 8.0_p1-r4	All supported architectures

Description

OpenSSH, when built with “xmss” USE flag enabled, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key.

NOTE: This USE flag is disabled by default!

Impact

A remote attacker could connect to a vulnerable OpenSSH server using a special crafted XMSS key possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.

Workaround

Disable XMSS key type.

Resolution

All OpenSSH users should upgrade to the latest version:

      # emerge --sync
      # emerge --ask --oneshot --verbose
      ">=net-misc/openssh/openssh-8.0_p1-r4"

References

CVE-2019-16905

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201911-01.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.