USN-597-1: OpenSSH vulnerability

1 April 2008

openssh vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 7.10
  • Ubuntu 7.04
  • Ubuntu 6.10
  • Ubuntu 6.06 LTS

Software Description

  • openssh

Details

Timo Juhani Lindfors discovered that the OpenSSH client, when port forwarding was requested, would listen on any available address family. A local attacker could exploit this flaw on systems with IPv6 enabled to hijack connections, including X11 forwards.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 7.10
openssh-client - 1:4.6p1-5ubuntu0.2
Ubuntu 7.04
openssh-client - 1:4.3p2-8ubuntu1.2
Ubuntu 6.10
openssh-client - 1:4.3p2-5ubuntu1.2
Ubuntu 6.06 LTS
openssh-client - 1:4.2p1-7ubuntu3.3

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system upgrade is sufficient to effect the necessary changes.

References