Vulmon
Amazon Linux AMI Security Advisory: ALAS-2016-638
Advisory Release Date: 2016-01-18 11:00 Pacific
Advisory Updated Date: 2016-01-18 11:00 Pacific
Severity:
Medium
Issue Overview:
An information leak flaw was found in the way the OpenSSH client roaming feature was implemented. A malicious server could potentially use this flaw to leak portions of memory (possibly including private SSH keys) of a successfully authenticated OpenSSH client.
A buffer overflow flaw was found in the way the OpenSSH client roaming feature was implemented. A malicious server could potentially use this flaw to execute arbitrary code on a successfully authenticated OpenSSH client if that client used certain non-default configuration options.
Affected Packages:
openssh
Issue Correction:
Run yum update openssh to update your system.
New Packages:
i686:
openssh-server-6.6.1p1-23.59.amzn1.i686
openssh-6.6.1p1-23.59.amzn1.i686
openssh-ldap-6.6.1p1-23.59.amzn1.i686
pam_ssh_agent_auth-0.9.3-9.23.59.amzn1.i686
openssh-debuginfo-6.6.1p1-23.59.amzn1.i686
openssh-clients-6.6.1p1-23.59.amzn1.i686
openssh-keycat-6.6.1p1-23.59.amzn1.i686
src:
openssh-6.6.1p1-23.59.amzn1.src
x86_64:
pam_ssh_agent_auth-0.9.3-9.23.59.amzn1.x86_64
openssh-keycat-6.6.1p1-23.59.amzn1.x86_64
openssh-server-6.6.1p1-23.59.amzn1.x86_64
openssh-debuginfo-6.6.1p1-23.59.amzn1.x86_64
openssh-clients-6.6.1p1-23.59.amzn1.x86_64
openssh-ldap-6.6.1p1-23.59.amzn1.x86_64
openssh-6.6.1p1-23.59.amzn1.x86_64