[ale] [Fwd: Portable OpenSSH 3.7.1p2 released]
jtaylor at onlinea.com
Tue Sep 23 12:38:15 EDT 2003
-------- Original Message --------
Subject: Portable OpenSSH 3.7.1p2 released
From: Damien Miller <djm at cvs.openbsd.org>
Date: Tue, September 23, 2003 8:39 am
To: openssh-unix-announce at mindrot.org
Portable OpenSSH 3.7.1p2 has just been released. It will be available
from the mirrors listed at http://www.openssh.com/portable.html shortly.
Please note that this is a release to address issues in the portable
version only. The items mentioned below do not affect the OpenBSD
OpenSSH is a 100% complete SSH protocol version 1.3, 1.5 and 2.0
implementation and includes sftp client and server support.
We would like to thank the OpenSSH community for their continued
support to the project, especially those who contributed source and
bought T-shirts or posters.
We have a new design of T-shirt available, more info on
For international orders use http://https.openbsd.org/cgi-bin/order and
for European orders, use http://https.openbsd.org/cgi-bin/order.eu
Portable OpenSSH version 3.7p1 and 3.7.1p1 contain multiple
vulnerabilities in the new PAM authentication code. At least one of
these bugs is remotely exploitable (under a non-standard
configuration, with privsep disabled).
OpenSSH 3.7.1p2 fixes these bugs. Please note that these bugs do not
exist in OpenBSD's releases of OpenSSH.
Changes since OpenSSH 3.7.1p1:
* This release disables PAM by default. To enable it, set "UsePAM yes"
sshd_config. Due to complexity, inconsistencies in the specification
and differences between vendors' PAM implementations we recommend that
PAM be left disabled in sshd_config unless there is a need for its
use. Sites using only public key or simple password authentication
usually have little need to enable PAM support.
* This release now requires zlib 1.1.4 to build correctly. Previous
versions have security problems.
* Fix compilation for versions of OpenSSL before 0.9.6. Some cipher
are not supported for older OpenSSL versions.
* Fix compilation problems on systems with a missing or lacking
* Workaround problems related to unimplemented or broken
functions on several platforms.
* Fix compilation on older OpenBSD systems.
* Fix handling of password-less authentication
that has not worked since the 3.7p1 release.
- MD5 (openssh-3.7.1p2.tar.gz) = 61cf5b059938718308836d00f6764a94
- please read http://www.openssh.com/report.html
OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt,
Kevin Steves, Damien Miller, Ben Lindstrom, Darren Tucker and Tim Rice.
More information about the Ale