- cross-posted to:
- techsploits@reddthat.com
- cross-posted to:
- techsploits@reddthat.com
The following summary from Debian’s security list:
The Qualys Threat Research Unit (TRU) discovered that OpenSSH, an implementation of the SSH protocol suite, is prone to a signal handler race condition. If a client does not authenticate within LoginGraceTime seconds (120 by default), then sshd’s SIGALRM handler is called asynchronously and calls various functions that are not async-signal-safe. A remote unauthenticated attacker can take advantage of this flaw to execute arbitrary code with root privileges. This flaw affects sshd in its default configuration.
openssh is typically quite robust, this is a rare exception