svn commit: r308202 - in releng/11.0: . crypto/openssh sys/conf

[Xin LI]

Author: delphij
Date: Wed Nov  2 07:23:19 2016
New Revision: 308202
URL: https://svnweb.freebsd.org/changeset/base/308202

Log:
  Fix Fix OpenSSH remote Denial of Service vulnerability.
  
  Security:	FreeBSD-SA-16:33.openssh
  Approved by:	so

Modified:
  releng/11.0/UPDATING
  releng/11.0/crypto/openssh/kex.c
  releng/11.0/sys/conf/newvers.sh

Modified: releng/11.0/UPDATING
==============================================================================
--- releng/11.0/UPDATING	Wed Nov  2 07:18:27 2016	(r308201)
+++ releng/11.0/UPDATING	Wed Nov  2 07:23:19 2016	(r308202)
@@ -16,6 +16,10 @@ from older versions of FreeBSD, try WITH
 the tip of head, and then rebuild without this option. The bootstrap process
 from older version of current across the gcc/clang cutover is a bit fragile.
 
+20161102	p3	FreeBSD-SA-16:33.openssh
+
+	Fix Fix OpenSSH remote Denial of Service vulnerability.
+
 20161025	p2	FreeBSD-SA-16:15.sysarch [revised]
 			FreeBSD-SA-16:32.bhyve
 

Modified: releng/11.0/crypto/openssh/kex.c
==============================================================================
--- releng/11.0/crypto/openssh/kex.c	Wed Nov  2 07:18:27 2016	(r308201)
+++ releng/11.0/crypto/openssh/kex.c	Wed Nov  2 07:23:19 2016	(r308202)
@@ -468,6 +468,7 @@ kex_input_kexinit(int type, u_int32_t se
 	if (kex == NULL)
 		return SSH_ERR_INVALID_ARGUMENT;
 
+	ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, NULL);
 	ptr = sshpkt_ptr(ssh, &dlen);
 	if ((r = sshbuf_put(kex->peer, ptr, dlen)) != 0)
 		return r;

Modified: releng/11.0/sys/conf/newvers.sh
==============================================================================
--- releng/11.0/sys/conf/newvers.sh	Wed Nov  2 07:18:27 2016	(r308201)
+++ releng/11.0/sys/conf/newvers.sh	Wed Nov  2 07:23:19 2016	(r308202)
@@ -32,7 +32,7 @@
 
 TYPE="FreeBSD"
 REVISION="11.0"
-BRANCH="RELEASE-p2"
+BRANCH="RELEASE-p3"
 if [ -n "${BRANCH_OVERRIDE}" ]; then
 	BRANCH=${BRANCH_OVERRIDE}
 fi