Bug 3493

Summary: Security Advisory - openssh - CVE-2011-4327
Product: [Build System, Metadata & Runtime] OE-Core Reporter: Li Wang <li.wang>
Component: connectivityAssignee: Li Wang <li.wang>
Status: RESOLVED INVALID QA Contact:
Severity: normal    
Priority: Undecided CC: meta.mr.watcher, meta.watcher, sgw, song.liu, zhenfeng.zhao
Version: 1.4   
Target Milestone: ---   
Hardware: x86   
OS: Multiple   
Whiteboard: P2
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: ---

Description Li Wang 2012-11-27 02:29:09 UTC 
A security flaw was found in the way ssh-keysign, a ssh helper program for host based authentication, attempted to retrieve enough entropy information on configurations that lacked a built-in entropy pool in OpenSSL (a ssh-rand-helper program would be executed to retrieve the entropy from the system environment). A local attacker could use this flaw to obtain unauthorized access to host keys via ptrace(2) process trace attached to the 'ssh-rand-helper' program.

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4327
Comment 2 Li Wang 2012-12-12 01:54:20 UTC 
openssh version is 6.0p1 on poky, and it need not the cve patch.
Because:

On 30 November 2012 22:41, Scott Garman <scott.a.garman@intel.com> wrote:
> > The second link you referenced above explains that the vulnerability exists
> > in versions prior to openssh 5.8p2, and yet your patch was submitted against
> > openssh 6.0p1. So it seems that this would not apply. Or am I
> > misunderstanding the nature of the bug?

Prior to 5.8p2 *and* not Linux:

2. Affected configurations

        Portable OpenSSH prior to version 5.8p2 only on platforms
        that are configured to use ssh-rand-helper for entropy
        collection.

        ssh-rand-helper is enabled at configure time when it is
        detected that OpenSSL does not have a built-in source of
        randomness, and only used at runtime if this condition
        remains. Platforms that support /dev/random or otherwise
        configure OpenSSL with a random number provider are not
        vulnerable.

        In particular, *BSD, OS X, Cygwin and Linux are not
        affected.

The function has already been removed from OpenSSH prior to version 5.8p2:
ChangeLog:
20110505
- (djm) [Makefile.in WARNING.RNG aclocal.m4 buildpkg.sh.in configure.ac]
  [entropy.c ssh-add.c ssh-agent.c ssh-keygen.c ssh-keyscan.c]
  [ssh-keysign.c ssh-pkcs11-helper.c ssh-rand-helper.8 ssh-rand-helper.c]
  [ssh.c ssh_prng_cmds.in sshd.c contrib/aix/buildbff.sh]
  [regress/README.regress] Remove ssh-rand-helper and all its
  tentacles. PRNGd seeding has been rolled into entropy.c directly.
  Thanks to tim@ for testing on affected platforms.

So, please revert the patch.
Thanks,
LiWang.