-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 --------------------------------------------------------------------------
   Turbolinux Security Advisory TLSA-2006-45
   http://www.turbolinux.co.jp/security/
                                             security-team@turbolinux.co.jp
 --------------------------------------------------------------------------

 Original released date: 27 Dec 2006
 Last revised: 27 Dec 2006

 Package: openssh

 Summary: Bypass Authentication

 More information:
    OpenSSH is a FREE version of the SSH connectivity tools that
    technical users of the Internet rely on.

    Unspecified vulnerability in the sshd Privilege Separation Monitor in OpenSSH
    causes weaker verification that authentication has been successful,
    which might allow attackers to bypass authentication.

 Impact:
    The openssh might allow remote attackers to bypass authentication.

 Affected Products:
    - Turbolinux Appliance Server 2.0
    - Turbolinux FUJI
    - Turbolinux 10 Server x64 Edition
    - Turbolinux Appliance Server 1.0 Hosting Edition
    - Turbolinux Appliance Server 1.0 Workgroup Edition
    - Turbolinux 10 Server
    - Turbolinux Home
    - Turbolinux 10 F...
    - Turbolinux 10 Desktop
    - Turbolinux Multimedia
    - Turbolinux Personal
    - Turbolinux 8 Server


 <Turbolinux Appliance Server 2.0>

   Source Packages
   Size: MD5

   openssh-3.9p1-10.src.rpm
       912218 cffd59cf47abd89ba5f8340d9c32fa93

   Binary Packages
   Size: MD5

   openssh-3.9p1-10.i586.rpm
       189590 962ecbc0019398ddba7d4de39b31db72
   openssh-askpass-3.9p1-10.i586.rpm
        36741 732958dddbff639ab5a87c525a22d264
   openssh-clients-3.9p1-10.i586.rpm
       215506 bc3f9c7b5d17ecac1b2410226bfefb43
   openssh-server-3.9p1-10.i586.rpm
       217426 a9f2e12c25726d7753c270c1d9328de2

 <Turbolinux FUJI>

   Source Packages
   Size: MD5

   openssh-4.1p1-6.src.rpm
       953831 5ec212ccf8da38d8c4176fe5e8d72323

   Binary Packages
   Size: MD5

   openssh-4.1p1-6.i686.rpm
       235260 a2ba55646531dc720919c989472fdf25
   openssh-askpass-4.1p1-6.i686.rpm
        37726 2a469c274407b6e5f555d6a35097469c
   openssh-clients-4.1p1-6.i686.rpm
       254477 53b0117e789e04e229f798172be2835c
   openssh-server-4.1p1-6.i686.rpm
       256699 976e7452cd28b363209e44b6bb0ecda9

 <Turbolinux 10 Server x64 Edition>

   Source Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/x64/Server/10/updates/SRPMS/openssh-3.9p1-10.src.rpm
       912218 fd61149cadcc1edeaa114773d0814813

   Binary Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/x64/Server/10/updates/RPMS/openssh-3.9p1-10.x86_64.rpm
       203060 d07668b73f1ebd378554997d6aa9adc6
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/x64/Server/10/updates/RPMS/openssh-askpass-3.9p1-10.x86_64.rpm
        38672 075fff8afd358252efa9977edb303304
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/x64/Server/10/updates/RPMS/openssh-clients-3.9p1-10.x86_64.rpm
       237472 f7cc8315ad918317389d95d427a8d02d
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/x64/Server/10/updates/RPMS/openssh-server-3.9p1-10.x86_64.rpm
       246343 2f0ed089d433e5674ff37f5c0f8c52bd

 <Turbolinux Appliance Server 1.0 Hosting Edition>

   Source Packages
   Size: MD5

   openssh-3.7.1p2-11.src.rpm
       852149 f6b8fea5a088b813bd0ecc7806743aeb

   Binary Packages
   Size: MD5

   openssh-3.7.1p2-11.i586.rpm
       195335 7e06f2e0de93e93ad7da487ff39ed004
   openssh-askpass-3.7.1p2-11.i586.rpm
        34372 b35a9ae3af163358d298df4e147adc17
   openssh-clients-3.7.1p2-11.i586.rpm
       216865 004716e561ed26fc067a6709d14e4c43
   openssh-server-3.7.1p2-11.i586.rpm
       225688 57cd3ddf9d995e03aa391b732ff29fd1

 <Turbolinux Appliance Server 1.0 Workgroup Edition>

   Source Packages
   Size: MD5

   openssh-3.7.1p2-11.src.rpm
       852149 e30d21ea4ec731a10dad5999d3f5563e

   Binary Packages
   Size: MD5

   openssh-3.7.1p2-11.i586.rpm
       195507 886bcb762552cd5f823bbbfcc7e5a7db
   openssh-askpass-3.7.1p2-11.i586.rpm
        34535 9f49f1cfdedd8bafa06b18d7d44c3a71
   openssh-clients-3.7.1p2-11.i586.rpm
       217016 af348db8d93f2cba9fdbad978956703a
   openssh-server-3.7.1p2-11.i586.rpm
       225857 f614533f76b3b8b8216a334610cc2503

 <Turbolinux 10 Server>

   Source Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/SRPMS/openssh-3.9p1-10.src.rpm
       912218 cffd59cf47abd89ba5f8340d9c32fa93

   Binary Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/RPMS/openssh-3.9p1-10.i586.rpm
       189590 962ecbc0019398ddba7d4de39b31db72
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/RPMS/openssh-askpass-3.9p1-10.i586.rpm
        36741 732958dddbff639ab5a87c525a22d264
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/RPMS/openssh-clients-3.9p1-10.i586.rpm
       215506 bc3f9c7b5d17ecac1b2410226bfefb43
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/RPMS/openssh-server-3.9p1-10.i586.rpm
       217426 a9f2e12c25726d7753c270c1d9328de2

 <Turbolinux 10 Desktop, Turbolinux 10 F..., Turbolinux Home, Turbolinux Multimedia, Turbolinux Personal>

   Source Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/updates/SRPMS/openssh-3.8p1-11.src.rpm
       882898 84d1533207026b4fae448318837f7dac

   Binary Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/updates/RPMS/openssh-3.8p1-11.i586.rpm
       193151 04fdb22a7e46190b0e567f0a5a834b23
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/updates/RPMS/openssh-askpass-3.8p1-11.i586.rpm
        36704 9a175230fa3fb065ef07ddc1e2bd7056
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/updates/RPMS/openssh-clients-3.8p1-11.i586.rpm
       211896 32824c4556a4408c1a7e04915b120ef8
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/updates/RPMS/openssh-server-3.8p1-11.i586.rpm
       214538 44c271de723fc3f1bf9ade5f8023d077

 <Turbolinux 8 Server>

   Source Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/SRPMS/openssh-3.7.1p2-11.src.rpm
       852149 c438cdbda07e226e12f0620e803bfb2a

   Binary Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/openssh-3.7.1p2-11.i586.rpm
       195488 0155bcc80027c891635b529bf6c989bb
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/openssh-askpass-3.7.1p2-11.i586.rpm
        34540 73a7a73148954d92c79a57f215690c7b
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/openssh-askpass-gnome-3.7.1p2-11.i586.rpm
        15839 e39a058fb24edcfb9e0c02269cb9530c
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/openssh-clients-3.7.1p2-11.i586.rpm
       217022 c7633ee5f86135b272fe5115ae2c26ff
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/openssh-server-3.7.1p2-11.i586.rpm
       225712 655590eb9d99aa54261f7e905c26276e


 References:

 CVE
   [CVE-2006-5794]
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5794

 --------------------------------------------------------------------------
 Revision History
    27 Dec 2006 Initial release
 --------------------------------------------------------------------------

 Copyright(C) 2006 Turbolinux, Inc. All rights reserved. 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)

iD8DBQFFkhePK0LzjOqIJMwRAvtsAJ9X5MtbZyxk/tE5ar5lOtE6b1Xz4ACgp2IH
IUTvWufulVidKNpunhArABs=
=7Pfr
-----END PGP SIGNATURE-----