5 files changed, 44 insertions, 4 deletions

diff --git a/debian/.git-dpm b/debian/.git-dpm
index cc2aee698..935f783bc 100644
--- a/debian/.git-dpm
+++ b/debian/.git-dpm
@@ -1,6 +1,6 @@
 # see git-dpm(1) from git-dpm package
-810eecd6b2e03770f21e46b5cb8ce8c7fcd46da8
-810eecd6b2e03770f21e46b5cb8ce8c7fcd46da8
+12577aa167c76d517bfe78f603fe805f190d8d05
+12577aa167c76d517bfe78f603fe805f190d8d05
 544df7a04ae5b5c1fc30be7c445ad685d7a02dc9
 544df7a04ae5b5c1fc30be7c445ad685d7a02dc9
 openssh_6.9p1.orig.tar.gz
diff --git a/debian/changelog b/debian/changelog
index 06ec4ab09..e77d3462a 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -129,6 +129,12 @@ openssh (1:6.9p1-1) UNRELEASED; urgency=medium
       SendEnv and AcceptEnv; bz#2386
     - sshd(8): Format UsePAM setting when using sshd -T (closes: #767648).
     - moduli(5): Update DH-GEX moduli (closes: #787037).
+  * There are some things I want to fix before upgrading to 7.0p1, though I
+    intend to do that soon.  In the meantime, backport security patches:
+    - SECURITY: sshd(8): OpenSSH 6.8 and 6.9 incorrectly set TTYs to be
+      world-writable.  Local attackers may be able to write arbitrary
+      messages to logged-in users, including terminal escape sequences.
+      Reported by Nikolay Edigaryev.
   * Thanks to Jakub Jelen of Red Hat for Fedora's rebased version of the
     GSSAPI key exchange patch.
 
diff --git a/debian/patches/backport-fix-pty-permissions.patch b/debian/patches/backport-fix-pty-permissions.patch
new file mode 100644
index 000000000..2cff74911
--- /dev/null
+++ b/debian/patches/backport-fix-pty-permissions.patch
@@ -0,0 +1,33 @@
+From 12577aa167c76d517bfe78f603fe805f190d8d05 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Thu, 30 Jul 2015 23:09:15 +0000
+Subject: Fix pty permissions
+
+Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=6f941396b6835ad18018845f515b0c4fe20be21a
+Forwarded: not-needed
+Last-Update: 2015-08-19
+
+Patch-Name: backport-fix-pty-permissions.patch
+---
+ sshpty.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sshpty.c b/sshpty.c
+index 0e32b39..e89efb7 100644
+--- a/sshpty.c
++++ b/sshpty.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: sshpty.c,v 1.29 2014/09/03 18:55:07 djm Exp $ */
++/* $OpenBSD: sshpty.c,v 1.30 2015/07/30 23:09:15 djm Exp $ */
+ /*
+  * Author: Tatu Ylonen <ylo@cs.hut.fi>
+  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+@@ -197,7 +197,7 @@ pty_setowner(struct passwd *pw, const char *tty, const char *role)
+        /* Determine the group to make the owner of the tty. */
+        grp = getgrnam("tty");
+        gid = (grp != NULL) ? grp->gr_gid : pw->pw_gid;
+-       mode = (grp != NULL) ? 0622 : 0600;
++       mode = (grp != NULL) ? 0620 : 0600;
+ 
+        /*
+         * Change owner and mode of the tty as required.
diff --git a/debian/patches/series b/debian/patches/series
index bbc7a5fb4..bee70bc30 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -27,3 +27,4 @@ no-openssl-version-status.patch
 gnome-ssh-askpass2-icon.patch
 sigstop.patch
 debian-config.patch
+backport-fix-pty-permissions.patch
diff --git a/sshpty.c b/sshpty.c
index 0e32b392b..e89efb74a 100644
--- a/sshpty.c
+++ b/sshpty.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshpty.c,v 1.29 2014/09/03 18:55:07 djm Exp $ */
+/* $OpenBSD: sshpty.c,v 1.30 2015/07/30 23:09:15 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -197,7 +197,7 @@ pty_setowner(struct passwd *pw, const char *tty, const char *role)
         /* Determine the group to make the owner of the tty. */
         grp = getgrnam("tty");
         gid = (grp != NULL) ? grp->gr_gid : pw->pw_gid;
-        mode = (grp != NULL) ? 0622 : 0600;
+        mode = (grp != NULL) ? 0620 : 0600;
 
         /*
          * Change owner and mode of the tty as required.