Release Announcements

Copssh 5.4.3

release date:

2016-01-31

Changelog

Copssh version 5.4.3 bundle contains 32/64-bit client/server installers containing OpenSSL 1.0.2f fixing security vulnerabilities CVE-2016-0701 (high) and CVE-2015-3197 (low). We have also updated Cygwin and GNU tools to their latest versions.

2016

Nagwin 2.5.1

release date:

2016-01-24

Changelog

Nagwin 2.5.1 contains PHP 5.6.17 with a security fix addressing CVE-2016-1903. New Nagios 4.1.1 network map should also display as expected now. We have also updated Cygwin/GNU tools, in addition to fixing a bug causing some pnp4Nagios templates not working.

2016

Copssh 5.4.2

release date:

2016-01-14

Changelog

Copssh version 5.4.2 bundle contains 32/64-bit client/server installers with OpenSSH 7.1p2, fixing security vulnerabilities. Changes from 7.1.p1:

CVE-2016-0777 SECURITY: ssh(1): The OpenSSH client code between 5.4 and 7.1 contains experimental support for resuming SSH-connections (roaming).

The matching server code has never been shipped, but the client code was enabled by default and could be tricked by a malicious server into leaking client memory to the server, including private client user keys. The authentication of the server host key prevents exploitation by a man-in-the-middle, so this information leak is restricted to connections to malicious or compromised servers. MITIGATION: For OpenSSH >= 5.4 the vulnerable code in the client can be completely disabled by adding 'UseRoaming no' to the gobal ssh_config(5) file, or to user configuration in ~/.ssh/config, or by passing -oUseRoaming=no on the command line. This problem was reported by the Qualys Security Advisory team.

SECURITY: Fix an out of-bound read access in the packet handling code. Reported by Ben Hawkes.

PROTOCOL: Correctly interpret the 'first_kex_follows' option during the intial key exchange. Reported by Matt Johnston.

Further use of explicit_bzero has been added in various buffer handling code paths to guard against compilers aggressively doing dead-store removal.

2016

cwRsync 5.5.0 (security)

release date:

2015-12-27

Changelog

Version 5.5.0 of cwRsync client/server installers and the free archive contain the latest available rsync (3.1.2), including a security fix for a transfer from a sender that you don't fully trust. We have also updated OpenSSL with security fixes (1.0.2e), some other GNU tools and the sample batch file cwrsync.cmd for client connections, solving HOME directory related problems.

2015

Copssh 5.4.1 (security)

release date:

2015-12-18

Changelog

Copssh version 5.4.1 bundle contains 32/64-bit client/server installers with updated OpenSSL and Cygwin/GNU tools. OpenSSL 1.0.2e fixes 5 security vulnerabilities:

Moderate - BN_mod_exp may produce incorrect results on x86_64 (CVE-2015-3193)
Moderate - Certificate verify crash with missing PSS parameter (CVE-2015-3194)
Moderate - X509_ATTRIBUTE memory leak (CVE-2015-3195)
Low - Race condition handling PSK identify hint (CVE-2015-3196)
Low - Anon DH ServerKeyExchange with 0 p parameter (CVE-2015-1794)

We have also updated Cygwin/GNU Tools to the latest stable versions. Enjoy!

2015

cwRsync 5.4.5

release date:

2015-11-15

Changelog

Version 5.4.5 of cwRsync installers contains the latest available Cygwin DLL (2.3.1) and more effective installation logic without dependency on external utilities. See version page for more details. Our server installers create service accounts with stronger passwords (from 14 to 24 chars), and you will now get the option to remove the service account during uninstallation. Problems around Windows paths in the HOME env.variable when invoking from a non-Cygwin environment, should also be solved as the regarding official patch is now undone.

2015

Nagwin 2.5.0

release date:

2015-09-29

Changelog

Nagwin 2.5.0 contains the latest available Nagios version 4.1.1, including new graphical CGI displays and promoting JSON CGIs to released status, in addition to many bug fixes. PHP is also updated to the latest version (5.6.13).

2015

cwRsync 5.4.4

release date:

2015-09-09

Changelog

Version 5.4.4 of cwRsync installers come with newer versions of Cygwin, OpenSSH and OpenSSL. See version page for more details.

2015

Copssh 5.4.0 (security)

release date:

2015-08-22

Changelog

Copssh version 5.4.0 bundle contains 32/64-bit client/server installers with OpenSSH 7.1, a bug fix release:

Security

sshd(8): OpenSSH 7.0 contained a logic error in PermitRootLogin=prohibit-password/without-password that could, depending on compile-time configuration, permit password authentication to root while preventing other forms of authentication. This problem was reported by Mantas Mikulenas.

Bugfixes

ssh(1), sshd(8): add compatibility workarounds for FuTTY
ssh(1), sshd(8): refine compatibility workarounds for WinSCP
Fix a number of memory faults (double-free, free of uninitialised memory, etc) in ssh(1) and ssh-keygen(1). Reported by Mateusz Kocielski.

Future deprecation notice from OpenSSH:

We plan on retiring more legacy cryptography in the next release including:

Refusing all RSA keys smaller than 1024 bits (the current minimum is 768 bits)
Several ciphers will be disabled by default: blowfish-cbc, cast128-cbc, all arcfour variants and the rijndael-cbc aliases for AES.
MD5-based HMAC algorithms will be disabled by default.

This list reflects our current intentions, but please check the final release notes for OpenSSH 7.2 when it is released.

2015

Copssh 5.3.0 (security)

release date:

2015-08-11

Changelog

Copssh version 5.3.0 bundle contains 32/64-bit client/server installers with OpenSSH 7.0. Focus of this release is primarily to deprecate weak, legacy and/or unsafe cryptography:

Support for the legacy SSH version 1 protocol is disabled by default at compile time.
Support for the 1024-bit diffie-hellman-group1-sha1 key exchange is disabled by default at run-time. It may be re-enabled using the instructions at http://www.openssh.com/legacy.html
Support for ssh-dss, ssh-dss-cert-* host and user keys is disabled by default at run-time. These may be re-enabled using the instructions at http://www.openssh.com/legacy.html
Support for the legacy v00 cert format has been removed.

Security related fixes:

sshd(8): OpenSSH 6.8 and 6.9 incorrectly set TTYs to be world-writable. Local attackers may be able to write arbitrary messages to logged-in users, including terminal escape sequences. Reported by Nikolay Edigaryev.
sshd(8): Portable OpenSSH only: Fixed a privilege separation weakness related to PAM support. Attackers who could successfully compromise the pre-authentication process for remote code execution and who had valid credentials on the host could impersonate other users. Reported by Moritz Jodeit.
sshd(8): Portable OpenSSH only: Fixed a use-after-free bug related to PAM support that was reachable by attackers who could compromise the pre-authentication process for remote code execution. Also reported by Moritz Jodeit.
sshd(8): fix circumvention of MaxAuthTries using keyboard-interactive authentication. By specifying a long, repeating keyboard-interactive "devices" string, an attacker could request the same authentication method be tried thousands of times in a single pass. The LoginGraceTime timeout in sshd(8) and any authentication failure delays implemented by the authentication mechanism itself were still applied. Found by Kingcope.

2015

Release Announcements

Copssh 5.4.3

Copssh 5.4.3

release date:

Nagwin 2.5.1

Nagwin 2.5.1

release date:

Copssh 5.4.2

Copssh 5.4.2

release date:

cwRsync 5.5.0 (security)

cwRsync 5.5.0 (security)

release date:

Copssh 5.4.1 (security)

Copssh 5.4.1 (security)

release date:

cwRsync 5.4.5

cwRsync 5.4.5

release date:

Nagwin 2.5.0

Nagwin 2.5.0

release date:

cwRsync 5.4.4

cwRsync 5.4.4

release date:

Copssh 5.4.0 (security)

Copssh 5.4.0 (security)

release date:

Copssh 5.3.0 (security)

Copssh 5.3.0 (security)

release date:

Pages

OpsBay - A Toolset for Independent Professionals

Featured product

win2ban - Fail2Ban for Windows