USN-2869-1: OpenSSH vulnerabilities

Ubuntu Security Notice USN-2869-1

14th January, 2016

openssh vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

• Ubuntu 15.10
• Ubuntu 15.04
• Ubuntu 14.04 LTS
• Ubuntu 12.04 LTS

Summary

OpenSSH could be made to expose sensitive information over the network.

Software description

• openssh - secure shell (SSH) for secure access to remote machines

Details

It was discovered that the OpenSSH client experimental support for resuming
connections contained multiple security issues. A malicious server could
use this issue to leak client memory to the server, including private
client user keys.

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 15.10:

openssh-client 1:6.9p1-2ubuntu0.1

Ubuntu 15.04:

openssh-client 1:6.7p1-5ubuntu1.4

Ubuntu 14.04 LTS:

openssh-client 1:6.6p1-2ubuntu2.4

Ubuntu 12.04 LTS:

openssh-client 1:5.9p1-5ubuntu1.8

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2016-0777, CVE-2016-0778