A security flaw was found in the way ssh-keysign, a ssh helper program for host based authentication, attempted to retrieve enough entropy information on configurations that lacked a built-in entropy pool in OpenSSL (a ssh-rand-helper program would be executed to retrieve the entropy from the system environment). A local attacker could use this flaw to obtain unauthorized access to host keys via ptrace(2) process trace attached to the 'ssh-rand-helper' program. https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4327
Merged into master: http://git.openembedded.org/?p=openembedded-core.git&a=commit;h=bdce08215396e5ab99ada5fa0f62c3b002a44582
openssh version is 6.0p1 on poky, and it need not the cve patch. Because: On 30 November 2012 22:41, Scott Garman <scott.a.garman@intel.com> wrote: > > The second link you referenced above explains that the vulnerability exists > > in versions prior to openssh 5.8p2, and yet your patch was submitted against > > openssh 6.0p1. So it seems that this would not apply. Or am I > > misunderstanding the nature of the bug? Prior to 5.8p2 *and* not Linux: 2. Affected configurations Portable OpenSSH prior to version 5.8p2 only on platforms that are configured to use ssh-rand-helper for entropy collection. ssh-rand-helper is enabled at configure time when it is detected that OpenSSL does not have a built-in source of randomness, and only used at runtime if this condition remains. Platforms that support /dev/random or otherwise configure OpenSSL with a random number provider are not vulnerable. In particular, *BSD, OS X, Cygwin and Linux are not affected. The function has already been removed from OpenSSH prior to version 5.8p2: ChangeLog: 20110505 - (djm) [Makefile.in WARNING.RNG aclocal.m4 buildpkg.sh.in configure.ac] [entropy.c ssh-add.c ssh-agent.c ssh-keygen.c ssh-keyscan.c] [ssh-keysign.c ssh-pkcs11-helper.c ssh-rand-helper.8 ssh-rand-helper.c] [ssh.c ssh_prng_cmds.in sshd.c contrib/aix/buildbff.sh] [regress/README.regress] Remove ssh-rand-helper and all its tentacles. PRNGd seeding has been rolled into entropy.c directly. Thanks to tim@ for testing on affected platforms. So, please revert the patch. Thanks, LiWang.