[ GLSA 201911-01 ] OpenSSH

[GLSA]

Gentoo Linux Security Advisory

Title: OpenSSH: Integer overflow (GLSA 201911-01)
Severity: normal
Exploitable: remote
Date: 2019-11-07
Bug(s): #697046
ID: 201911-01

Synopsis

An integer overflow in OpenSSH might allow an attacker to execute
arbitrary code.


Background

OpenSSH is a complete SSH protocol implementation that includes SFTP
client and server support.


Affected Packages

Package: net-misc/openssh
Vulnerable: >= 8.0_p1-r2
Unaffected: >= 8.0_p1-r4
Architectures: All supported architectures


Description

OpenSSH, when built with “xmss” USE flag enabled, has a
pre-authentication integer overflow if a client or server is configured
to use a crafted XMSS key.
NOTE: This USE flag is disabled by default!

Impact

A remote attacker could connect to a vulnerable OpenSSH server using a
special crafted XMSS key possibly resulting in execution of arbitrary
code with the privileges of the process or a Denial of Service condition.


Workaround

Disable XMSS key type.

Resolution

All OpenSSH users should upgrade to the latest version: