USN-2869-1: OpenSSH vulnerabilities

14 January 2016

openssh vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 15.10
  • Ubuntu 15.04
  • Ubuntu 14.04 LTS
  • Ubuntu 12.04 LTS

Summary

OpenSSH could be made to expose sensitive information over the network.

Software Description

  • openssh - secure shell (SSH) for secure access to remote machines

Details

It was discovered that the OpenSSH client experimental support for resuming connections contained multiple security issues. A malicious server could use this issue to leak client memory to the server, including private client user keys.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 15.10
openssh-client - 1:6.9p1-2ubuntu0.1
Ubuntu 15.04
openssh-client - 1:6.7p1-5ubuntu1.4
Ubuntu 14.04 LTS
openssh-client - 1:6.6p1-2ubuntu2.4
Ubuntu 12.04 LTS
openssh-client - 1:5.9p1-5ubuntu1.8

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References