OpenSSH 'sshd' Remote Memory Corruption Vulnerability

Release date:
Updated on:

Affected Systems:
OpenSSH Open SSH 6.3
OpenSSH Open SSH 6.2
Description:
--------------------------------------------------------------------------------
Bugtraq id: 63605
CVE (CAN) ID: CVE-2013-4548

OpenSSH is an open-source implementation of the SSH protocol.

OpenSSH 6.2 and 6.3 have errors after selecting a AES-GCM password during key exchange, which can cause indirect reference to uninitialized callback pointers and then execute arbitrary code.

<* Source: Markus Friedl

Link: http://secunia.com/advisories/55594/
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

OpenSSH
-------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.openssh.com/
Http://www.openssh.com/txt/gcmrekey.adv

OpenSSH details: click here
OpenSSH: click here

Solve the latency problem during remote login through OpenSSH

Offline installation of OpenSSH in Ubuntu 12.10

OpenSSH upgrade steps and precautions

Solutions for failures of common OpenSSH users

General thread: OpenSSH key management, Part 1 Understanding RSA/DSA authentication

Install OpenSSH and configure the sftp lock directory for RedHat