A vulnerability and a weakness have been reported in OpenSSH, which can be exploited by malicious people to disclose certain system information, cause a DoS (Denial of Service), and potentially compromise a vulnerable system.

1) A race condition exists within the signal handling. This can be exploited to crash the OpenSSH server and potentially allows the execution of arbitrary code.

The vulnerability is reported in version 4.3. Prior versions may also be affected.

2) An error in the processing of GSSAPI authentication requests can be exploited to determine if a username is valid.

The weakness is reported in versions prior to 4.4.

Solution
Update to OpenSSH 4.4.

Provided and/or discovered by
1) Mark Dowd

Changelog
Further details available in Customer Area

Original Advisory
http://openssh.org/txt/release-4.4

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area