-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security]  openssh (SSA:2016-014-01)

New openssh packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1,
and -current to fix security issues.


Here are the details from the Slackware 14.1 ChangeLog:
+--------------------------+
patches/packages/openssh-7.1p2-i486-1_slack14.1.txz:  Upgraded.
  This update fixes an information leak and a buffer overflow.  In particular,
  the information leak allows a malicious SSH server to steal the client's
  private keys.  Thanks to Qualys for reporting this issue.
  For more information, see:
    https://www.qualys.com/2016/01/14/cve-2016-0777-cve-2016-0778/openssh-cve-2016-0777-cve-2016-0778.txt
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0777
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0778
  *****************************************************************
  * IMPORTANT:  READ BELOW ABOUT POTENTIALLY INCOMPATIBLE CHANGES *
  *****************************************************************
  Rather than backport the fix for the information leak (which is the only
  hazardous flaw), we have upgraded to the latest OpenSSH.  As of version
  7.0, OpenSSH has deprecated some older (and presumably less secure)
  algorithms, and also (by default) only allows root login by public-key,
  hostbased and GSSAPI authentication.  Make sure that your keys and
  authentication method will allow you to continue accessing your system
  after the upgrade.
  The release notes for OpenSSH 7.0 list the following incompatible changes
  to be aware of:
  * Support for the legacy SSH version 1 protocol is disabled by
    default at compile time.
  * Support for the 1024-bit diffie-hellman-group1-sha1 key exchange
    is disabled by default at run-time. It may be re-enabled using
    the instructions at http://www.openssh.com/legacy.html
  * Support for ssh-dss, ssh-dss-cert-* host and user keys is disabled
    by default at run-time. These may be re-enabled using the
    instructions at http://www.openssh.com/legacy.html
  * Support for the legacy v00 cert format has been removed.
  * The default for the sshd_config(5) PermitRootLogin option has
    changed from "yes" to "prohibit-password".
  * PermitRootLogin=without-password/prohibit-password now bans all
    interactive authentication methods, allowing only public-key,
    hostbased and GSSAPI authentication (previously it permitted
    keyboard-interactive and password-less authentication if those
    were enabled).
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project!  :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/openssh-7.1p2-i486-1_slack13.0.txz

Updated package for Slackware x86_64 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/openssh-7.1p2-x86_64-1_slack13.0.txz

Updated package for Slackware 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/openssh-7.1p2-i486-1_slack13.1.txz

Updated package for Slackware x86_64 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/openssh-7.1p2-x86_64-1_slack13.1.txz

Updated package for Slackware 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/openssh-7.1p2-i486-1_slack13.37.txz

Updated package for Slackware x86_64 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/openssh-7.1p2-x86_64-1_slack13.37.txz

Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/openssh-7.1p2-i486-1_slack14.0.txz

Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/openssh-7.1p2-x86_64-1_slack14.0.txz

Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/openssh-7.1p2-i486-1_slack14.1.txz

Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/openssh-7.1p2-x86_64-1_slack14.1.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/openssh-7.1p2-i586-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/openssh-7.1p2-x86_64-1.txz


MD5 signatures:
+-------------+

Slackware 13.0 package:
856dd9c1b10641c282f30a34b7b63bea  openssh-7.1p2-i486-1_slack13.0.txz

Slackware x86_64 13.0 package:
80903b0829f0284d007e7a316f2ff2da  openssh-7.1p2-x86_64-1_slack13.0.txz

Slackware 13.1 package:
2095d1a304a94bab44993fdb7e0781c8  openssh-7.1p2-i486-1_slack13.1.txz

Slackware x86_64 13.1 package:
5bf653d7f5b4a9426ff2c5888af99f00  openssh-7.1p2-x86_64-1_slack13.1.txz

Slackware 13.37 package:
53e09b4371c045b9de1c86e0826324f9  openssh-7.1p2-i486-1_slack13.37.txz

Slackware x86_64 13.37 package:
cd0319ff3c574c50612d5ba2b38f2fdc  openssh-7.1p2-x86_64-1_slack13.37.txz

Slackware 14.0 package:
98cdc1d6ffea2a06d0c8013078681bff  openssh-7.1p2-i486-1_slack14.0.txz

Slackware x86_64 14.0 package:
2093f3e91a79e07f072c702a1704be73  openssh-7.1p2-x86_64-1_slack14.0.txz

Slackware 14.1 package:
d051d9f31cd380436ad01fa1641be1c7  openssh-7.1p2-i486-1_slack14.1.txz

Slackware x86_64 14.1 package:
f1f81757431c3c836f06ce5d22e2d5de  openssh-7.1p2-x86_64-1_slack14.1.txz

Slackware -current package:
70db20c5e4152bc9967b1e24cf91ed98  n/openssh-7.1p2-i586-1.txz

Slackware x86_64 -current package:
e13dc3da27f817bee693fbb907015817  n/openssh-7.1p2-x86_64-1.txz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg openssh-7.1p2-i486-1_slack14.1.txz

Next, restart the sshd daemon:
# sh /etc/rc.d/rc.sshd restart

Then before logging out, make sure that you still have remote access!
See the information about incompatible changes in OpenSSH 7.x above.


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list:                          |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message:                                                     |
|                                                                        |
|   unsubscribe slackware-security                                       |
|                                                                        |
| You will get a confirmation message back containing instructions to    |
| complete the process.  Please do not reply to this email address.      |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAlaYWioACgkQakRjwEAQIjOwpACfXviFRy4mQxr63HyYu9zLgZ+Z
dVsAn0sLTJYcXuCSQYnXNp+FYuIKWjVh
=dePf
-----END PGP SIGNATURE-----