OpenSSH (portable) contains a flaw that may allow a remote attacker to execute arbitrary code under some circumstances. When configured with GSSAPI authentication, the signal handler is prone to a race condition that could be exploited to conduct a Denial of Service and possibly execute arbitrary code. No further details have been provided. Note: On OpenSSH, this vulnerability can only be leveraged for a remote Denial of Service. The conditions for remote exploitation to execute arbitrary code are considered to be unlikely.

Upgrade to version 4.4 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Security Tracker: 1020891
• CVE ID: 2006-5051 (see also: NVD) 2008-4109 (see also: NVD)
• Bugtraq ID: 20241
• Secunia Advisory ID: 22158 22173 22183 22196 22208 22236 22245 22270 22352 22362 22487 22495 22823 22926 23680 24799 24805 31885 32080 32181
• SCIP VulDB ID: 2578
• ISS X-Force ID: 29254 45202
• Other Advisory URL: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:22.openssh.asc http://www-unix.globus.org/mail_archive/security-announce/2007/04/msg00000.html
  http://www.debian.org/security/2008/dsa-1638
  http://www.us.debian.org/security/2006/dsa-1189
  http://www.us.debian.org/security/2006/dsa-1212
• Vendor Specific Advisory URL: ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc http://docs.info.apple.com/article.html?artnum=305214
  http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00004.html
  http://lists.suse.com/archive/suse-security-announce/2006-Oct/0005.html
  http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.592566
  http://support.avaya.com/elmodocs2/security/ASA-2006-216.htm
  http://www.gentoo.org/security/en/glsa/glsa-200611-06.xml
  http://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2012-08-686&viewMode=view
  http://www.mandriva.com/security/advisories?name=MDKSA-2006:179
  http://www.openbsd.org/errata.html#ssh
  http://www.ubuntu.com/usn/usn-355-1
  http://www.ubuntu.com/usn/usn-649-1
  http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html
• Vendor Specific News/Changelog Entry: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=498678
  http://marc.theaimsgroup.com/?l=openbsd-cvs&m=115589252024127&w=2
  http://openssh.org/txt/release-4.4
• Mail List Post: http://lists.debian.org/debian-security-announce/2008/msg00227.html
• RedHat RHSA: RHSA-2006:0697 RHSA-2006:0697-9 RHSA-2006:0698

• Mark Dowd - Avertavertlabs.com - McAfee Avert(tm) Labs