[ddr] dsa-086.wml

[Pierre Machard <pmachard@tuxfamily.org>]

re bonsoir,

je vous envoie cette fois la relecture du dsa-086.wml (openssh). 
J'ai toujours le 
problème de remote root exploit. Je pense qu'il serait intéressant 
de proposer une bonne définition car c'est un terme récurrent pour la
sécurité.....

Autre problème la phrase  «the SSH CRC-32 compensation attack
detector vulnerability» 
que j'ai traduit par la vulnérabilité du détecteur 
compensatif d'attaque de SSH CRC-32

Je ne suis pas un spécialiste d'openSSH, j'ai cherché assez longuement
la signification de cette phrase, et je n'ai rien trouvé de mieux que
ceci.

Merci pour vos suggestions,

bonne relecture et à bientôt,

-- 
				Pierre Machard
<pmachard@tuxfamily.org>                                  TuxFamily.org
<pmachard@techmag.net>                                      techmag.net
+33 6 681 783 65                     http://migus.tuxfamily.org/gpg.txt
GPG: 1024D/23706F87 : B906 A53F 84E0 49B6 6CF7  82C2 B3A0 2D66 2370 6F87

<define-tag description>remote root exploit</define-tag>
<define-tag moreinfo>
<p>We have received reports that the "SSH CRC-32 compensation attack
detector vulnerability" is being actively exploited. This is the same
integer type error previously corrected for OpenSSH in DSA-027-1.
OpenSSH (the Debian ssh package) was fixed at that time, but
ssh-nonfree and ssh-socks were not.</p>

<p>Though packages in the non-free section of the archive are not
officially supported by the Debian project, we are taking the unusual
step of releasing updated ssh-nonfree/ssh-socks packages for those
users who have not yet migrated to OpenSSH. However, we do recommend
that our users migrate to the regularly supported, DFSG-free "ssh"
package as soon as possible. ssh 1.2.3-9.3 is the OpenSSH package
available in Debian 2.2r4.</p>

<p>The fixed ssh-nonfree/ssh-socks packages are available in version
1.2.27-6.2 for use with Debian 2.2 (potato) and version 1.2.27-8 for
use with the Debian unstable/testing distribution. Note that the new
ssh-nonfree/ssh-socks packages remove the setuid bit from the ssh
binary, disabling rhosts-rsa authentication. If you need this
functionality, run</p>
<p><code>chmod u+s /usr/bin/ssh1</code></p>
<p>after installing the new package.</p>
</define-tag>

# do not modify the following line
#include "$(ENGLISHDIR)/security/2001/dsa-086.data"