OpenSSH 4.7 released!

Das OpenSSH-Projekt hat soeben in einer Announce-Mail bekanntgegeben, dass OpenSSH ab sofort in Version 4.7 verfügbar ist.

OpenSSH 4.7 has just been released. It will be available from the mirrors listed at http://www.openssh.com shortly.

Neben einem Security-Fix X11-Cookies betreffend gibt es einige Verbesserungen. Aus der Release-Mitteilung:

Changes since OpenSSH 4.6:
========================

Security bugs resolved in this release:

• Prevent ssh(1) from using a trusted X11 cookie if creation of an untrusted cookie fails; found and fixed by Jan Pechanec.

Other changes, new functionality and fixes in this release:

• sshd(8) in new installations defaults to SSH Protocol 2 only. Existing installations are unchanged.
• The SSH channel window size has been increased, and both ssh(1) sshd(8) now send window updates more aggressively. These improves performance on high-BDP (Bandwidth Delay Product) networks.
• ssh(1) and sshd(8) now preserve MAC contexts between packets, which saves 2 hash calls per packet and results in 12-16% speedup for arcfour256/hmac-md5.
• A new MAC algorithm has been added, UMAC-64 (RFC4418) as “umac-64@openssh.com”. UMAC-64 has been measured to be approximately 20% faster than HMAC-MD5.
• A -K flag was added to ssh(1) to set GSSAPIAuthentication=Yes
• Failure to establish a ssh(1) TunnelForward is now treated as a fatal error when the ExitOnForwardFailure option is set.
• ssh(1) returns a sensible exit status if the control master goes away without passing the full exit status. (bz #1261)
• The following bugs have been fixed in this release:
  • When using a ProxyCommand in ssh(1), set the outgoing hostname with gethostname(2), allowing hostbased authentication to work (bz #616)
  • Make scp(1) skip FIFOs rather than hanging (bz #856)
  • Encode non-printing characters in scp(1) filenames. these could cause copies to be aborted with a “protocol error” (bz #891)
  • Handle SIGINT in sshd(8) privilege separation child process to ensure that wtmp and lastlog records are correctly updated (bz #1196)
  • Report GSSAPI mechanism in errors, for libraries that support multiple mechanisms (bz #1220)
  • Improve documentation for ssh-add(1)'s -d option (bz #1224)
  • Rearrange and tidy GSSAPI code, removing server-only code being linked into the client. (bz #1225)
  • Delay execution of ssh(1)'s LocalCommand until after all forwadings have been established. (bz #1232)
  • In scp(1), do not truncate non-regular files (bz #1236)
  • Improve exit message from ControlMaster clients. (bz #1262)
  • Prevent sftp-server(8) from reading until it runs out of buffer space, whereupon it would exit with a fatal error. (bz #1286)
• Portable OpenSSH bugs fixed:
  • Fix multiple inclusion of paths.h on AIX 5.1 systems. (bz #1243)
  • Implement getpeereid for Solaris using getpeerucred. Solaris systems will now refuse ssh-agent(1) and ssh(1) ControlMaster clients from different, non-root users (bz #1287)
  • Fix compilation warnings by including string.h if found. (bz #1294)
  • Remove redefinition of _res in getrrsetbyname.c for platforms that already define it. (bz #1299)
  • Fix spurious “chan_read_failed for istate 3” errors from sshd(8), a side-effect of the “hang on exit” fix introduced in 4.6p1. (bz #1306)
  • pam_end() was not being called if authentication failed (bz #1322)
  • Fix SELinux support when SELinux is in permissive mode. Previously sshd(8) was treating SELinux errors as always fatal. (bz #1325)
  • Ensure that pam_setcred(…, PAM_ESTABLISH_CRED) is called before pam_setcred(…, PAM_REINITIALIZE_CRED), fixing pam_dhkeys. (bz #1339)
  • Fix privilege separation on QNX – pre-auth only, this platform does not support file descriptior passing needed for post-auth privilege separation. (bz #1343)

Danke an das OpenBSD- und OpenSSH-Team für diese hervorragende Software!