Re: [cobalt-security] Significant OpenSSH Vulnerability ??

["Jonathan Michaelson" <michaelsonjd@xxxxxxxxxxx>]

Michael,

> > http://www.linuxsecurity.com/articles/cryptography_article-5185.html
> > Did you read, the article ? Does an patch come till Thursday ?
>
> The OpenSSH mailing list and OpenSSH bugtracker mention that the
> privilege-separation support for Linux with 2.2.X kernels (and a few other
> architectures) is broken.
>
> So the only RaQ where privilege separation works is the RaQ550. I've run
into
> that issue when I built PKGs with OpenSSH-3.3p1 two days ago.

I've just upgraded on a non-RaQ RH6.2 running 2.2.19 and got privilege
seperation to work. I initially got the following error:
fatal: mmap(65536): Invalid argument

But searched around a bit and found that if you set the following in
sshd_config:
Compression no

It then works fine with priv seperation. I haven't tried it on a Cobalt RaQ4
yet, but will do so shortly. Might be something worth trying if you've still
got the build handy.

--
Regards,
Jonathan Michaelson
Commercial CGI Scripting, Web Hosting
Web-based Email, Homepage Creation and Live Help products
http://www.webumake.com