Ubuntu Security Notice USN-597-1
1st April, 2008
openssh vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 7.10
- Ubuntu 7.04
- Ubuntu 6.10
- Ubuntu 6.06 LTS
Software description
- openssh
Details
Timo Juhani Lindfors discovered that the OpenSSH client, when port
forwarding was requested, would listen on any available address family.
A local attacker could exploit this flaw on systems with IPv6 enabled
to hijack connections, including X11 forwards.
Update instructions
The problem can be corrected by updating your system to the following package version:
- Ubuntu 7.10:
- openssh-client 1:4.6p1-5ubuntu0.2
- Ubuntu 7.04:
- openssh-client 1:4.3p2-8ubuntu1.2
- Ubuntu 6.10:
- openssh-client 1:4.3p2-5ubuntu1.2
- Ubuntu 6.06 LTS:
- openssh-client 1:4.2p1-7ubuntu3.3
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system upgrade is sufficient to effect the
necessary changes.