-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

IBM SECURITY ADVISORY

First Issued: Thu Jun 10 13:10:35 CDT 2010
===============================================================================
                           VULNERABILITY SUMMARY

VULNERABILITY:   AIX OpenSSH multiple vulnerabilities

PLATFORMS:       AIX 5.2, 5.3, 6.1

SOLUTION:        Apply the fix as described below.

THREAT:          See below

CERT VU Number:  n/a
CVE Numbers:     n/a
===============================================================================
                           DETAILED INFORMATION

I. DESCRIPTION

    X11 man-in-the-middle attack:
    When attempting to bind(2) to a port that has previously been bound
    with SO_REUSEADDR set, most operating systems check that either the
    effective user-id matches the previous bind (common on BSD-derived
    systems) or that the bind addresses do not overlap. When the
    sshd_config(5) option X11UseLocalhost has been set to "no" - an
    attacker may establish a more-specific bind, which will be used in
    preference to sshd's wildcard listener.
 

    Plaintext Recovery Attack Against SSH:
    If exploited, this attack can potentially allow an attacker to
    recover up to 32 bits of plaintext from an arbitrary block of 
    ciphertext from a connection secured using the SSH protocol in 
    the standard configuration. If OpenSSH is used in the standard 
    configuration, then the attacker's success probability for 
    recovering 32 bits of plaintext is 2^{-18}. A variant of the 
    attack against OpenSSH in the standard configuration can verifiably recover 14 
    bits of plaintext with probability 2^{-14}. The success probability 
    of the attack for other implementations of SSH is not known.

    Please see the following for more information:

    http://www.openssh.com/txt/release-5.1
    http://www.cpni.gov.uk/Docs/Vulnerability_Advisory_SSH.txt
    http://www.openssh.org/txt/cbc.adv

II. PLATFORM VULNERABILITY ASSESSMENT

    To determine if your system is vulnerable, execute the following
    command:

    lslpp -L openssh.base.server

    The following fileset levels are vulnerable:

    AIX 6.1: all versions less than 5.2.0.5300
    AIX 5.3: all versions less than 5.2.0.5300
    AIX 5.2: all versions

III. FIXES

    A fix is available, and it can be downloaded from:

    AIX 5.3:
    http://downloads.sourceforge.net/openssh-aix/openssh_5.2p1_aix53.tar.Z
    AIX 6.1:
    http://downloads.sourceforge.net/openssh-aix/openssh_5.2p1_aix61.tar.Z

IV. WORKAROUNDS

    X11 man-in-the-middle attack:
    Use the default value for X11UseLocalhost which  is "yes"

    Plaintext Recovery Attack Against SSH:
    AES CTR mode and arcfour ciphers are not vulnerable to this attack at all. 
    These may be preferentially selected by placing the following directive 
    in sshd_config and ssh_config:
    Ciphers aes128-ctr,aes256-ctr,arcfour256,arcfour,aes128-cbc,aes256-cbc

V. CONTACT INFORMATION

    If you would like to receive AIX Security Advisories via email,
    please visit:

        http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd
 
    Comments regarding the content of this announcement can be
    directed to:

        security-alert@austin.ibm.com

    To request the PGP public key that can be used to communicate
    securely with the AIX Security Team you can either:

        A. Send an email with "get key" in the subject line to:

            security-alert@austin.ibm.com

        B. Download the key from a PGP Public Key Server. The key ID is:

            0x28BFAA12

    Please contact your local IBM AIX support center for any
    assistance.

    eServer is a trademark of International Business Machines
    Corporation.  IBM, AIX and pSeries are registered trademarks of
    International Business Machines Corporation.  All other trademarks
    are property of their respective holders.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (AIX)

iD8DBQFMF90M4fmd+Ci/qhIRAjHPAKCf5zzuIXpzyy2oWU6RvKArAHU4ZgCfU5P3
+gWNiGxq+h0nTsbgnmNGGt8=
=gMSu
-----END PGP SIGNATURE-----