Fedora Account System
Red Hat Associate
Red Hat Customer
OpenSSH version 6.9 fix weakness of agent locking (ssh-add -x) to password guessing by implementing an increasing failure delay, storing a salted hash of the password rather than the password itself and using a timing-safe comparison function for verifying unlock attempts. This problem was reported by Ryan Castellucci. Upstream patch: https://anongit.mindrot.org/openssh.git/commit/?h=V_6_9&id=9173d0fbe44de7ebcad8a15618e13a8b8d78902e External References: http://www.openssh.com/txt/release-6.9
Created openssh tracking bugs for this issue: Affects: fedora-all [bug 1238241]
Per http://openwall.com/lists/oss-security/2015/07/01/10 , MITRE did not assign a CVE to this issue: "Our current thought is that a CVE ID may not be needed because attacks against ssh-agent locking don't cross a privilege boundary. In other words, the changelog entry could be interpreted to mean addition of a new security feature related to a threat model that wasn't in the previous design goals (e.g., password guessing by malware running under the same account)."
openssh-6.6.1p1-13.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
openssh-6.9p1-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2015:2088 https://rhn.redhat.com/errata/RHSA-2015-2088.html