_______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2013:009 http://www.mandriva.com/security/ _______________________________________________________________________ Package : libssh Date : February 9, 2013 Affected: 2011. _______________________________________________________________________ Problem Description: A vulnerability has been found and corrected in libssh: The publickey_from_privatekey function in libssh before 0.5.4, when no algorithm is matched during negotiations, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a Client: Diffie-Hellman Key Exchange Init packet (CVE-2013-0176). The updated packages have been upgraded to the 0.5.4 version which is not affected by this issue. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0176 http://www.libssh.org/2013/01/22/libssh-0-5-4-security-release/ _______________________________________________________________________ Updated Packages: Mandriva Linux 2011: 6b77e873216ebd5f4d724c64456c37ad 2011/i586/libssh4-0.5.4-0.1-mdv2011.0.i586.rpm a5391c1fccb103b2ebf01a93b1b1d314 2011/i586/libssh-devel-0.5.4-0.1-mdv2011.0.i586.rpm 6aa21578dc71b57b560098295ac54967 2011/SRPMS/libssh-0.5.4-0.1.src.rpm Mandriva Linux 2011/X86_64: 701b17b035ae086c363971be3619db4d 2011/x86_64/lib64ssh4-0.5.4-0.1-mdv2011.0.x86_64.rpm 8300186fa57ddc710be45902dd590e5f 2011/x86_64/lib64ssh-devel-0.5.4-0.1-mdv2011.0.x86_64.rpm 6aa21578dc71b57b560098295ac54967 2011/SRPMS/libssh-0.5.4-0.1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com>
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.