Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
IMPORTANT: new ssh bug (with fix inside)
View unanswered posts
View posts from last 24 hours

Goto page 1, 2  Next  
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
xming
Guru
Guru


Joined: 02 Jul 2002
Posts: 441

PostPosted: Tue Sep 16, 2003 3:23 pm    Post subject: IMPORTANT: new ssh bug (with fix inside) Reply with quote

see
https://bugs.gentoo.org/show_bug.cgi?id=28873

There maybe already expoits on the wild
http://lists.netsys.com/pipermail/full-disclosure/2003-September/thread.html#10103
http://lists.netsys.com/pipermail/full-disclosure/2003-September/010116.html
http://slashdot.org/articles/03/09/16/1327248.shtml?tid=126&tid=172

for all the impatients (ebuild update isn't there yet)
Code:

cd /usr/portage/net-misc/openssh/
cp openssh-3.6.1_p2.ebuild openssh-3.7_p1.ebuild
emerge -f openssh-3.7_p1.ebuild
ebuild openssh-3.7_p1.ebuild digest
emerge openssh-3.7_p1.ebuild

EDIT:
Code:
/etc/init.d/sshd restart

Patch your machines NOW


Last edited by xming on Tue Sep 16, 2003 4:21 pm; edited 3 times in total
Back to top
View user's profile Send private message
xming
Guru
Guru


Joined: 02 Jul 2002
Posts: 441

PostPosted: Tue Sep 16, 2003 3:52 pm    Post subject: Sticky Reply with quote

can someone make this sticky? Or we have to post like zomies to get this on top :)

xming
Back to top
View user's profile Send private message
viperlin
Veteran
Veteran


Joined: 15 Apr 2003
Posts: 1319
Location: UK

PostPosted: Tue Sep 16, 2003 3:53 pm    Post subject: Reply with quote

i've closed external ssh access on my router, will wait until it's in portage properly (at least masked)
Back to top
View user's profile Send private message
HaeMaker
n00b
n00b


Joined: 13 Jan 2003
Posts: 13

PostPosted: Tue Sep 16, 2003 4:53 pm    Post subject: Only SSH? No problem with SSL? Reply with quote

Just to confirm, the problem is with SSH and not the underlying SSL?
Back to top
View user's profile Send private message
snutte
Apprentice
Apprentice


Joined: 24 Apr 2002
Posts: 181
Location: Sweden, Malmö

PostPosted: Tue Sep 16, 2003 5:03 pm    Post subject: Reply with quote

Code:

/etc/init.d/sshd stop

And waiting for update in portage. ;)
Back to top
View user's profile Send private message
shadow255
Guru
Guru


Joined: 04 Apr 2003
Posts: 412

PostPosted: Tue Sep 16, 2003 5:06 pm    Post subject: Reply with quote

Thanks for the instructions, Xming! Worked flawlessly here... otherwise, I might have been doing what some others have posted here :twisted:
_________________
Vogon poetry is of course the third worst in the Universe. -- Douglas Adams, The Hitchhiker's Guide to the Galaxy
Back to top
View user's profile Send private message
Nahamu
n00b
n00b


Joined: 01 Jul 2003
Posts: 9
Location: Boston, MA

PostPosted: Tue Sep 16, 2003 5:06 pm    Post subject: Re: IMPORTANT: new ssh bug (with fix inside) Reply with quote

xming wrote:

Patch your machines NOW


Did anyone else have a compilation failure?

EDIT: My solution -- I had enabled kerberos and ipv6 for whatever reason. I unset those flags (which I don't really need) and it compiled fine. Hope this helps someone[/b]


Last edited by Nahamu on Tue Sep 16, 2003 5:12 pm; edited 2 times in total
Back to top
View user's profile Send private message
taveren
Tux's lil' helper
Tux's lil' helper


Joined: 24 Jul 2002
Posts: 145
Location: London, Ontario

PostPosted: Tue Sep 16, 2003 5:09 pm    Post subject: Reply with quote

Just did an rsync (1:05pm EST) and a new OpenSSH is available in portage.
Back to top
View user's profile Send private message
octavianh
n00b
n00b


Joined: 18 Aug 2003
Posts: 22

PostPosted: Tue Sep 16, 2003 5:17 pm    Post subject: Segmentation Fault Reply with quote

I just did an emerge sync and got the latest ebuilds and then I unmerged my old version and emerged the new one and I get this every time I try to run ssh:

Code:
Segmentation fault (core dumped)


Does anyone know why this is happening?
Back to top
View user's profile Send private message
arand
Apprentice
Apprentice


Joined: 22 Apr 2003
Posts: 215

PostPosted: Tue Sep 16, 2003 5:25 pm    Post subject: Reply with quote

I did the same, now it is giving me this.

Code:
--13:33:44--  ftp://ftp.openbsd.org/pub/unix/OpenBSD/OpenSSH/portable/openssh-3.7p1.tar.gz
  (try: 5) => `/usr/portage/distfiles/openssh-3.7p1.tar.gz'
Connecting to ftp.openbsd.org[129.128.5.191]:21... connected.
Logging in as anonymous ...
Error in server greeting.
Giving up.


I guess I will have to wait or find another server.

Thanks for getting this ebuild up so fast.
Back to top
View user's profile Send private message
shadow255
Guru
Guru


Joined: 04 Apr 2003
Posts: 412

PostPosted: Tue Sep 16, 2003 5:26 pm    Post subject: Re: Segmentation Fault Reply with quote

octavianh wrote:
I just did an emerge sync and got the latest ebuilds and then I unmerged my old version and emerged the new one and I get this every time I try to run ssh:

Code:
Segmentation fault (core dumped)


Does anyone know why this is happening?

When encountering trouble with ssh, I always try to run it with debugging messages. Do you get more output if you run ssh with -v? Also, I would recommend against unmerging ssh before upgrading - if you had made any configuration choices in your ssh_config or sshd_config config files at any point in the past, they're gone now.
_________________
Vogon poetry is of course the third worst in the Universe. -- Douglas Adams, The Hitchhiker's Guide to the Galaxy
Back to top
View user's profile Send private message
viperlin
Veteran
Veteran


Joined: 15 Apr 2003
Posts: 1319
Location: UK

PostPosted: Tue Sep 16, 2003 5:51 pm    Post subject: Reply with quote

taveren wrote:
Just did an rsync (1:05pm EST) and a new OpenSSH is available in portage.

i just did one about 1 minute ago and it's not... (ebuild is not in /usr/portage/net-misc/openssh/ )
Back to top
View user's profile Send private message
octavianh
n00b
n00b


Joined: 18 Aug 2003
Posts: 22

PostPosted: Tue Sep 16, 2003 6:12 pm    Post subject: Grrrr Reply with quote

This is what I'm getting:

Code:
OpenSSH_3.6.1p2, SSH protocols 1.5/2.0, OpenSSL 0x009060af
debug1: Reading configuration data /etc/ssh/ssh_config
Segmentation fault


I even tried reinstalling the old version again and it is also doing the same thing. I checked the ssh_config file and it IS there and there is nothing in it except the default stuff which is all commented out. Also, the permissions are set to 644 on the file and I'm trying this as root.
Back to top
View user's profile Send private message
tedj
n00b
n00b


Joined: 10 Jul 2003
Posts: 49

PostPosted: Tue Sep 16, 2003 6:13 pm    Post subject: Reply with quote

I just did a emerge sync and emerge openssh, then verified that the buffer.c file is indeed the sept 16 one with the correct patch.

(I have also restarted sshd and verified that it does not coredump for me. Maybe try to sync and emerge again, then do the etc-update?)

# emerge sync
# emerge -p openssh
# emerge openssh
# etc-update
# /etc/init.d/sshd stop
# /etc/init.d/sshd start


Its there, folks. Emerge away.
Back to top
View user's profile Send private message
blk_jack
Apprentice
Apprentice


Joined: 10 May 2002
Posts: 298
Location: Toronto

PostPosted: Tue Sep 16, 2003 6:18 pm    Post subject: Re: Grrrr Reply with quote

octavianh wrote:
This is what I'm getting:

Code:
OpenSSH_3.6.1p2, SSH protocols 1.5/2.0, OpenSSL 0x009060af
debug1: Reading configuration data /etc/ssh/ssh_config
Segmentation fault


I even tried reinstalling the old version again and it is also doing the same thing. I checked the ssh_config file and it IS there and there is nothing in it except the default stuff which is all commented out. Also, the permissions are set to 644 on the file and I'm trying this as root.


I am getting the same, no idea why.
Back to top
View user's profile Send private message
meyerm
Veteran
Veteran


Joined: 27 Jun 2002
Posts: 1311
Location: Munich / Germany

PostPosted: Tue Sep 16, 2003 6:18 pm    Post subject: Re: IMPORTANT: new ssh bug (with fix inside) Reply with quote

Nahamu wrote:
My solution -- I had enabled kerberos and ipv6 for whatever reason. I unset those flags (which I don't really need) and it compiled fine. Hope this helps someone

It did. Thank you! :-D
Back to top
View user's profile Send private message
shadow255
Guru
Guru


Joined: 04 Apr 2003
Posts: 412

PostPosted: Tue Sep 16, 2003 6:35 pm    Post subject: Re: Grrrr Reply with quote

octavianh wrote:
This is what I'm getting:

Code:
OpenSSH_3.6.1p2, SSH protocols 1.5/2.0, OpenSSL 0x009060af
debug1: Reading configuration data /etc/ssh/ssh_config
Segmentation fault


I even tried reinstalling the old version again and it is also doing the same thing. I checked the ssh_config file and it IS there and there is nothing in it except the default stuff which is all commented out. Also, the permissions are set to 644 on the file and I'm trying this as root.

Ouch. Perhaps there is something going on with USE flags on your system. Can you post output from emerge --info?
_________________
Vogon poetry is of course the third worst in the Universe. -- Douglas Adams, The Hitchhiker's Guide to the Galaxy
Back to top
View user's profile Send private message
paranode
l33t
l33t


Joined: 06 Mar 2003
Posts: 679
Location: Texas

PostPosted: Tue Sep 16, 2003 6:40 pm    Post subject: Re: Grrrr Reply with quote

octavianh wrote:
This is what I'm getting:

Code:
OpenSSH_3.6.1p2, SSH protocols 1.5/2.0, OpenSSL 0x009060af
debug1: Reading configuration data /etc/ssh/ssh_config
Segmentation fault


I even tried reinstalling the old version again and it is also doing the same thing. I checked the ssh_config file and it IS there and there is nothing in it except the default stuff which is all commented out. Also, the permissions are set to 644 on the file and I'm trying this as root.


The version you need should be openssh-3.7_p1, you are still showing the old one.
_________________
Meh.
Back to top
View user's profile Send private message
octavianh
n00b
n00b


Joined: 18 Aug 2003
Posts: 22

PostPosted: Tue Sep 16, 2003 6:44 pm    Post subject: here's more info Reply with quote

First of all, I know the version is 3.6... that's cause I tried to reinstall the old one and the old one crashes also. I'm not dumb. Here is the info from emerge:

Code:

Portage 2.0.49-r4 (default-x86-1.4, gcc-3.3.1, glibc-2.3.2-r1, 2.4.20-gentoo-r6)
=================================================================
System uname: 2.4.20-gentoo-r6 i686 AMD Athlon(TM) XP 2000+
ACCEPT_KEYWORDS="x86 ~x86"
AUTOCLEAN="yes"
CFLAGS="-O3 -march=athlon-xp -funroll-loops -pipe"
CHOST="i686-pc-linux-gnu"
COMPILER="gcc3"
CONFIG_PROTECT="/etc /var/qmail/control /usr/kde/2/share/config /usr/kde/3/share/config /usr/X11R6/lib/X11/xkb /usr/kde/3.1/share/config /usr/share/texmf/tex/generic/config/ /usr/share/texmf/tex/platex/config/ /usr/share/config"
CONFIG_PROTECT_MASK="/etc/gconf /etc/env.d"
CXXFLAGS="-O3 -march=athlon-xp -funroll-loops -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="sandbox ccache autoaddcvs"
GENTOO_MIRRORS="http://gentoo.oregonstate.edu http://distro.ibiblio.org/pub/Linux/distributions/gentoo"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="oss apm encode foomaticdb gpm libg++ mad mikmod ncurses nls spell xv gdbm berkdb slang readline bonobo tcltk tcpd perl motif -apache2 X gtk gtk2 gnome gtkhtml mozsvg alsa arts crypt cups curl gd gif imap java jpeg kde maildir mbox mcal mpeg mozilla mysql oggvorbis pdflib png postgres qt python ssl tiff truetype xml2 xmms zlib x86 dvd avi 3dnow cdr dga directfb esd evo fbcon flash gb gphoto2 imlib lcms libgda libwww mmx opengl pam quicktime samba scanner sdl slp sse svga tetex usb videos wmf"


Also, here is the -pv info from the specific package:

Code:

These are the packages that I would merge, in order:
 
Calculating dependencies ...done!
[ebuild   R   ] net-misc/openssh-3.7_p1  -ipv6 -static +pam +tcpd -kerberos -selinux -X509 -skey
Back to top
View user's profile Send private message
shadow255
Guru
Guru


Joined: 04 Apr 2003
Posts: 412

PostPosted: Tue Sep 16, 2003 7:49 pm    Post subject: Re: here's more info Reply with quote

octavianh wrote:
First of all, I know the version is 3.6... that's cause I tried to reinstall the old one and the old one crashes also. I'm not dumb. Here is the info from emerge:

Code:

Portage 2.0.49-r4 (default-x86-1.4, gcc-3.3.1, glibc-2.3.2-r1, 2.4.20-gentoo-r6)
=================================================================
System uname: 2.4.20-gentoo-r6 i686 AMD Athlon(TM) XP 2000+
ACCEPT_KEYWORDS="x86 ~x86"
AUTOCLEAN="yes"
CFLAGS="-O3 -march=athlon-xp -funroll-loops -pipe"
CHOST="i686-pc-linux-gnu"
COMPILER="gcc3"
CONFIG_PROTECT="/etc /var/qmail/control /usr/kde/2/share/config /usr/kde/3/share/config /usr/X11R6/lib/X11/xkb /usr/kde/3.1/share/config /usr/share/texmf/tex/generic/config/ /usr/share/texmf/tex/platex/config/ /usr/share/config"
CONFIG_PROTECT_MASK="/etc/gconf /etc/env.d"
CXXFLAGS="-O3 -march=athlon-xp -funroll-loops -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="sandbox ccache autoaddcvs"
GENTOO_MIRRORS="http://gentoo.oregonstate.edu http://distro.ibiblio.org/pub/Linux/distributions/gentoo"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="oss apm encode foomaticdb gpm libg++ mad mikmod ncurses nls spell xv gdbm berkdb slang readline bonobo tcltk tcpd perl motif -apache2 X gtk gtk2 gnome gtkhtml mozsvg alsa arts crypt cups curl gd gif imap java jpeg kde maildir mbox mcal mpeg mozilla mysql oggvorbis pdflib png postgres qt python ssl tiff truetype xml2 xmms zlib x86 dvd avi 3dnow cdr dga directfb esd evo fbcon flash gb gphoto2 imlib lcms libgda libwww mmx opengl pam quicktime samba scanner sdl slp sse svga tetex usb videos wmf"


Also, here is the -pv info from the specific package:

Code:

These are the packages that I would merge, in order:
 
Calculating dependencies ...done!
[ebuild   R   ] net-misc/openssh-3.7_p1  -ipv6 -static +pam +tcpd -kerberos -selinux -X509 -skey

The only thing I see which gives me concern is in your compiler flags. -funroll-loops is a pretty aggressive optimization which I wouldn't normally recommend for general-purpose makes. Try changing that in /etc/make.conf and see whether that makes a difference with openssh.

[Removed unnecessary blather here!] Sorry, I was reading the output from emerge --info like it was the make.conf file...
_________________
Vogon poetry is of course the third worst in the Universe. -- Douglas Adams, The Hitchhiker's Guide to the Galaxy
Back to top
View user's profile Send private message
neuron
Advocate
Advocate


Joined: 28 May 2002
Posts: 2371

PostPosted: Tue Sep 16, 2003 8:03 pm    Post subject: Reply with quote

<_neuron_> damit... /me just emerge -DU openssh on unstable tree, ssh segfaulted, used last version, and it still segfaults, suggestions anyone?
<genone> gcc-3.3.1-r2 ?
<_neuron_> yeah
<genone> it's broken
<_neuron_> .... argh, don't stuff like gcc go through a bit of testing as masked before getting unmasked?
<genone> looks as if most programs compiled with -r2 segfault
Back to top
View user's profile Send private message
viperlin
Veteran
Veteran


Joined: 15 Apr 2003
Posts: 1319
Location: UK

PostPosted: Tue Sep 16, 2003 8:10 pm    Post subject: Reply with quote

just to let everyone know the ebuild in portage is working fine for me
Back to top
View user's profile Send private message
licor
n00b
n00b


Joined: 01 Sep 2003
Posts: 36

PostPosted: Tue Sep 16, 2003 8:26 pm    Post subject: openssh 3.7p1 compiled using gcc-3.3.1-r2 cordumping Reply with quote

neuron wrote:
<_neuron_> damit... /me just emerge -DU openssh on unstable tree, ssh segfaulted, used last version, and it still segfaults, suggestions anyone?
<genone> gcc-3.3.1-r2 ?
<_neuron_> yeah
<genone> it's broken
<_neuron_> .... argh, don't stuff like gcc go through a bit of testing as masked before getting unmasked?
<genone> looks as if most programs compiled with -r2 segfault


does anyone have a way to solve this yet? (openssh 3.7p1 compiled using gcc-3.3.1-r2 cordumping) :?
Back to top
View user's profile Send private message
tseng
Retired Dev
Retired Dev


Joined: 02 Aug 2003
Posts: 33
Location: York, Pa.

PostPosted: Tue Sep 16, 2003 8:26 pm    Post subject: Reply with quote

guys having trouble with gcc-3.3.1-r2:

mv $(gcc-config -L)/libgcc_s.a $(gcc-config -L)/libgcc.a
and remerge ssh
Back to top
View user's profile Send private message
licor
n00b
n00b


Joined: 01 Sep 2003
Posts: 36

PostPosted: Tue Sep 16, 2003 8:30 pm    Post subject: Reply with quote

tseng wrote:
guys having trouble with gcc-3.3.1-r2:

mv $(gcc-config -L)/libgcc_s.a $(gcc-config -L)/libgcc.a
and remerge ssh


thanks, worked like a charm.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Goto page 1, 2  Next
Page 1 of 2

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum