security.access.redhat.com Open in urlscan Pro
2a02:26f0:3100::210:6e99  Public Scan

Form analysis
0 forms found in the DOM

Text Content

OPENSSH BLACKLIST SCRIPT

22nd August 2008

Last week Red Hat detected an intrusion on certain of its computer systems and
took immediate action. While the investigation into the intrusion is on-going,
our initial focus was to review and test the distribution channel we use with
our customers, Red Hat Network (RHN) and its associated security measures. Based
on these efforts, we remain highly confident that our systems and processes
prevented the intrusion from compromising RHN or the content distributed via RHN
and accordingly believe that customers who keep their systems updated using Red
Hat Network are not at risk. We are issuing this alert primarily for those who
may obtain Red Hat binary packages via channels other than those of official Red
Hat subscribers.

In connection with the incident, the intruder was able to get a small number of
OpenSSH packages relating only to Red Hat Enterprise Linux 4 (i386 and x86_64
architectures only) and Red Hat Enterprise Linux 5 (x86_64 architecture only)
signed. As a precautionary measure, we are releasing an updated version of these
packages and have published a list of the tampered packages and how to detect
them.

To reiterate, our processes and efforts to date indicate that packages obtained
by Red Hat Enterprise Linux subscribers via Red Hat Network are not at risk.

We have provided a shell script which lists the affected packages and can verify
that none of them are installed on a system:

 * openssh-blacklist-1.0.sh

The script has a detached GPG signature from the Red Hat Security Response Team
so you can verify its integrity:

 * openssh-blacklist-1.0.sh.asc
 * How to verify the scripts signature

This script can be executed either as a non-root user or as root. To execute the
script after downloading it and saving it to your system, run the command:

   bash ./openssh-blacklist-1.0.sh

If the script output includes any lines beginning with "ALERT" then a tampered
package has been installed on the system. Otherwise, if no tampered packages
were found, the script should produce only a single line of output beginning
with the word "PASS", as shown below:

   bash ./openssh-blacklist-1.0.sh
   PASS: no suspect packages were found on this system


The script can also check a set of packages by passing it a list of source or
binary RPM filenames. In this mode, a "PASS" or "ALERT" line will be printed for
each filename passed; for example:

   bash ./openssh-blacklist-1.0.sh openssh-4.3p2-16.el5.i386.rpm
   PASS: signature of package "openssh-4.3p2-16.el5.i386.rpm" not on blacklist


Red Hat customers who discover any tampered packages, need help with running
this script, or have any questions should log into the Red Hat Customer Portal
and file a support ticket, call their local support center, or contact their
Technical Account Manager.