Segfaults with ssh from Red Hat 6.2 openssh-clients-2.5.1p2-1.i386.rpm

[Richard Johnson]

The segfault logged below occurs on two different Red Hat 6.2 systems
running OpenSSH installed from the 2.5.1p2 RPM.  (Similar problems occured
with the 2.5.1p1 RPM.)

The most recent of the Red Hat 6.2 systems tested is stock except for an
upgrade of rpm-3.0.5-9.6x.i386.rpm and the install of Red Hat's release of
openssl-0.9.5a-3.i386.rpm, both necessary for the OpenSSH RPM install.

The segfaults occur when connecting to OpenSSH 2.3.0p1 (Solaris 7), OpenSSH
2.5.1p1 (Solaris 2.5.1), OpenSSH 2.3.X (OpenBSD), and OpenSSH 2.5.X
(OpenBSD current as of January), among other systems.

The segfaults do not occur when connecting to localhost on the Red Hat 6.2 box.

Is this a known problem with the ssh-clients RPM for 2.5.1p2?  I can
provide core dumps if anyone is interested.


Richard

------

# openssh -v -v -v server.example.com  # running Solaris 7, OpenSSH 2.3.0p1
OpenSSH_2.5.1p2, SSH protocols 1.5/2.0, OpenSSL 0x0090581f
debug: Reading configuration data /etc/ssh/ssh_config
debug: ssh_connect: getuid 0 geteuid 0 anon 0
debug: Connecting to server.example.com [192.168.8.223] port 22.
debug: Seeding random number generator
debug: Allocated local port 678.
debug: Connection established.
debug: identity file /root/.ssh/identity type 3
debug: identity file /root/.ssh/id_dsa type 3
debug: Remote protocol version 1.99, remote software version OpenSSH_2.3.0p1
debug: match: OpenSSH_2.3.0p1 pat ^OpenSSH_2\.3\.0
debug: Local version string SSH-1.5-OpenSSH_2.5.1p2
debug: Waiting for server public key.
debug: Received server public key (768 bits) and host key (1024 bits).
Segmentation fault (core dumped)

# openssh -v -v -v -2 server.example.com  # running Solaris 7, OpenSSH 2.3.0p1
OpenSSH_2.5.1p2, SSH protocols 1.5/2.0, OpenSSL 0x0090581f
debug: Reading configuration data /etc/ssh/ssh_config
debug: ssh_connect: getuid 0 geteuid 0 anon 0
debug: Connecting to server.example.com [192.168.8.223] port 22.
debug: Seeding random number generator
debug: Allocated local port 652.
debug: Connection established.
debug: identity file /root/.ssh/id_dsa type 3
debug: Remote protocol version 1.99, remote software version OpenSSH_2.3.0p1
debug: match: OpenSSH_2.3.0p1 pat ^OpenSSH_2\.3\.0
Enabling compatibility mode for protocol 2.0
debug: Local version string SSH-2.0-OpenSSH_2.5.1p2
debug: send KEXINIT
debug: done
debug: wait KEXINIT
debug: got kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha
1
debug: got kexinit: ssh-dss
debug: got kexinit: 3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes128-cbc,aes192-
cbc,aes256-cbc,rijndael128-cbc,rijndael192-cbc,rijndael256-cbc,rijndael-cbc at lysa
tor.liu.se
debug: got kexinit: 3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes128-cbc,aes192-
cbc,aes256-cbc,rijndael128-cbc,rijndael192-cbc,rijndael256-cbc,rijndael-cbc at lysa
tor.liu.se
debug: got kexinit: hmac-sha1,hmac-md5,hmac-ripemd160 at openssh.com
debug: got kexinit: hmac-sha1,hmac-md5,hmac-ripemd160 at openssh.com
debug: got kexinit: none,zlib
debug: got kexinit: none,zlib
debug: got kexinit:
debug: got kexinit:
debug: first kex follow: 0
debug: reserved: 0
debug: done
debug: mac_init: found hmac-sha1
debug: kex: server->client 3des-cbc hmac-sha1 none
debug: mac_init: found hmac-sha1
debug: kex: client->server 3des-cbc hmac-sha1 none
debug: Sending SSH2_MSG_KEX_DH_GEX_REQUEST.
debug: Wait SSH2_MSG_KEX_DH_GEX_GROUP.
debug: Got SSH2_MSG_KEX_DH_GEX_GROUP.
debug: bits set: 516/1024
debug: Sending SSH2_MSG_KEX_DH_GEX_INIT.
debug: Wait SSH2_MSG_KEX_DH_GEX_REPLY.
debug: Got SSH2_MSG_KEXDH_REPLY.
Segmentation fault (core dumped)