Release announcements

Copssh version 5.3.0 bundle contains 32/64-bit client/server installers with OpenSSH 7.0. Focus of this release is primarily to deprecate weak, legacy and/or unsafe cryptography:

• Support for the legacy SSH version 1 protocol is disabled by default at compile time.
• Support for the 1024-bit diffie-hellman-group1-sha1 key exchange is disabled by default at run-time. It may be re-enabled using the instructions at http://www.openssh.com/legacy.html
• Support for ssh-dss, ssh-dss-cert-* host and user keys is disabled by default at run-time. These may be re-enabled using the instructions at http://www.openssh.com/legacy.html
• Support for the legacy v00 cert format has been removed.

 Security related fixes:

• sshd(8): OpenSSH 6.8 and 6.9 incorrectly set TTYs to be world-writable. Local attackers may be able to write arbitrary messages to logged-in users, including terminal escape sequences. Reported by Nikolay Edigaryev.
• sshd(8): Portable OpenSSH only: Fixed a privilege separation weakness related to PAM support. Attackers who could successfully compromise the pre-authentication process for remote code execution and who had valid credentials on the host could impersonate other users. Reported by Moritz Jodeit.
• sshd(8): Portable OpenSSH only: Fixed a use-after-free bug related to PAM support that was reachable by attackers who could compromise the pre-authentication process for remote code execution. Also reported by Moritz Jodeit.
• sshd(8): fix circumvention of MaxAuthTries using keyboard-interactive authentication. By specifying a long, repeating keyboard-interactive "devices" string, an attacker could request the same authentication method be tried thousands of times in a single pass. The LoginGraceTime timeout in sshd(8) and any authentication failure delays implemented by the authentication mechanism itself were still applied. Found by Kingcope.

Copssh version 5.2.0 bundle contains 32/64-bit client/server installers with OpenSSH 6.9 and OpenSSL 1.0.2d binaries (CVE-2015-1793). As OpenSSH uses only the cryptoghraphic library part of OpenSSL, Copssh is not directly affected by this security advisory.

Copssh version 5.1.1 is a maintenance release and contains the latest available versions of Cygwin (2.0.2) and related GNU tools.

Nagwin 2.4.1 is a maintenance release and comes with the updated versions of PHP (5.6.8 including security related fixes for CVE-2015-1351 and CVE-2015-1352), Nginx (1.7.12) and Cygwin tools (1.7.35).

Copssh product version 5.1.0 comes with the latest available versions of OpenSSH (6.8, a major release) and OpenSSL (1.0.2a addressing many security vulnerabilities). Daemon program sshd is also patched to avoid logout hang problem as described in our previous blog.

Free edition is updated with the latest available OpenSSL (1.0.2a) as well.

Copssh version 5.0.4 comes with a custom patch addressing session hang problems during logout for domain users. Users experiencing the problem reported that they observe following lines in the event log:

error: chmod /dev/pty1 0666 failed: No such file or directory

error: chown /dev/pty1 0 0 failed: No such file or directory

As a result of that failure, you may observe multiple hanging sshd processes at the server side as well. Please upgrade if you experience those problems in your environment.

Contents of the custom patch:

--- sshpty.c 2014-05-21 09:06:47.000000000 +0200+++ sshpty.new.c 2015-03-06 17:26:49.125000000 +0100@@ -85,12 +85,7 @@ void pty_release(const char *tty) {-#ifndef __APPLE_PRIVPTY__- if (chown(tty, (uid_t) 0, (gid_t) 0) < 0)- error("chown %.100s 0 0 failed: %.100s", tty, strerror(errno));- if (chmod(tty, (mode_t) 0666) < 0)- error("chmod %.100s 0666 failed: %.100s", tty, strerror(errno));-#endif /* __APPLE_PRIVPTY__ */+ return; }  /* Makes the tty the process's controlling tty and sets it to sane modes. */

Nagwin 2.4.0 product edition comes as a bundle containing both 32-bit and 64-bit Nagios core binaries. We have also upgraded Nginx, Php, Pnp4Nagios and Rrdtool to their latest versions, both 32-bit and 64-bit. In addition, Nginx comes with LDAP support, allowing you to use Active Directory authentication.

Version 4.2.2 of Winrpe installers come with newer versions of Cygwin and OpenSSL.

Version 5.4.2 of cwRsync installers come with newer versions of Cygwin and OpenSSL. We have also updated plink and puttygen to their latest available versions. See version page for more details.

Adolsign 2.5 introduces full language support in templates. While earlier versions were somewhat limited to ISO 8859-1 (Latin-1, Western European primarly), version 2.5 comes with the option --encoding, allowing you to use the language of your choice. A selected set of encodings supported:

ascii,euc-cn,euc-jp,euc-kr,iso-2022-jp,iso-2022-jp-1,iso-2022-kr,iso-8859-1,iso 8859-10,iso-8859-11,iso-8859-13,iso-8859-14,iso-8859-15,iso-8859-16,iso-8859-2,iso-8859-3,iso-8859-4,iso-8859-5,iso-8859-6,iso-8859-7,iso-8859-8,iso-8859-9,UCS-2BE,UCS-2LE,UTF-16,UTF-16BE,UTF-16LE,UTF-32,UTF-32BE,UTF-32LE,UTF-7,utf-8-strict,utf8

A complete list of encodings supported can be achieved by running the command "adolsign --encoding". Default encoding is still ISO-8859-1. As an example, you can convert your templates to UTF-8 encoding and use the command: adolsign --encoding utf8 .....