3

We have encountered a security threat in one of our RHEL servers which says the SSH server is configured to use Cipher Block Chaining.

As far as I know, the RHEL systems provide security updates through their RHN satellite which can be achieved just by running the yum update command. But, how can I know if the security patch is applied to my RHEL system?

P.S: I know the CVE number of the vulnerability/threat/issue.

So my question is, is it possible for me to verify that the RHEL yum update command has fixed the bug in my system?

3

You can check this with yum-plugin-security:

--cve  This option includes packages that say they fix a CVE - Common
       Vulnerabilities and Exposures ID (http://cve.mitre.org/about/),
       Eg. CVE-2201-0123.

So try:

yum --cve <Your CVE here> info updates

And you can check the changelog coressponding to the packages to check information about bug fixed:

$ rpm -q --changelog openssh | grep -i cve
- change default value of MaxStartups - CVE-2010-5107 - #908707
- merged cve-2007_3102 to audit patch
- fixed audit log injection problem (CVE-2007-3102)
- CVE-2006-5794 - properly detect failed key verify in monitor (#214641)
- CVE-2006-4924 - prevent DoS on deattack detector (#207957)
- CVE-2006-5051 - don't call cleanups from signal handler (#208459)
- use fork+exec instead of system in scp - CVE-2006-0225 (#168167)
| improve this answer | |
  • Your option really seems good. – Ramesh May 16 '14 at 18:50
2

Yes it is possible.

CVE is a dictionary of publicly known information security vulnerabilities and exposures. If we know the CVE number, we can check if RHEL has fixed the threat in our systems by checking the CVE number here.

So in my case, the CVE number was CVE-2008-5161. I checked for the CVE number in the above mentioned link and found that the fix for openssh was provided in the package provided by the update of this rpm.

So, I ran the query ssh -V which gives me the output as,

OpenSSH_4.3p2

But the above query just returns the version.

However, I need to know if the patch openssh-4.3p2-36 is applied to my system. The RHEL updates are applied in patches which do not update the package numbers. So, for example, if RHEL 5 systems have the OpenSSH version of 4.3 installed, the updates will not make it to the next 4.4 version but rather fix the same version but in patches. This feature is known as backporting in RHEL. So, for the security threat that I had faced, I need to verify the patch 36 is installed in my system. I can check the same using the command,

rpm -qa | grep -i ssh

The above command returns me the output as,

openssh-askpass-4.3p2-82.el5
libssh2-devel-1.2.7-1.el5.remi
openssh-server-4.3p2-82.el5
libssh2-1.2.7-1.el5.remi
openssh-clients-4.3p2-82.el5
openssh-4.3p2-82.el5

This means I have the latest security patch provided by RHEL available in my system.

| improve this answer | |
  • It's also worth mentioning that Red Hat provides an online CVE database that will tell you the specific versions of their software that resolve relevant CVE's. – Bratchley May 16 '14 at 19:12
  • 1
    @JoelDavis, I have included the link that you have specified in my answer :) – Ramesh May 16 '14 at 19:23
  • Damn. Having one of those days I guess. Sorry about that. – Bratchley May 16 '14 at 19:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.