USN-209-1: SSH server vulnerability

Releases

• Ubuntu 5.04
• Ubuntu 4.10

Details

An information disclosure vulnerability has been found in the SSH
server. When the GSSAPIAuthentication option was enabled, the SSH
server could send GSSAPI credentials even to users who attempted to
log in with a method other than GSSAPI. This could inadvertently
expose these credentials to an untrusted user.

Please note that this does not affect the default configuration of the
SSH server.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 5.04

• openssh-server -

Ubuntu 4.10

• openssh-server -

In general, a standard system update will make all the necessary changes.

References

• CVE-2005-2798