[ GLSA 200711-02 ] OpenSSH: Security bypass

[GLSA]

Gentoo Linux Security Advisory

Title: OpenSSH: Security bypass (GLSA 200711-02)
Severity: low
Exploitable: remote
Date: November 01, 2007
Bug(s): #191321
ID: 200711-02

Synopsis

A flaw has been discovered in OpenSSH which could allow a local attacker to bypass security restrictions.

Background

OpenSSH is a complete SSH protocol implementation that includes an SFTP client and server support.

Affected Packages

Package: net-misc/openssh
Vulnerable: < 4.7
Unaffected: >= 4.7
Architectures: All supported architectures


Description

Jan Pechanec discovered that OpenSSH uses a trusted X11 cookie when it cannot create an untrusted one.

Impact

An attacker could bypass the SSH client security policy and gain privileges by causing an X client to be treated as trusted.

Workaround

There is no known workaround at this time.

Resolution

All OpenSSH users should upgrade to the latest version: