OpenSSH: Security bypass

Background

OpenSSH is a complete SSH protocol implementation that includes an SFTP client and server support.

Description

Jan Pechanec discovered that OpenSSH uses a trusted X11 cookie when it cannot create an untrusted one.

Impact

An attacker could bypass the SSH client security policy and gain privileges by causing an X client to be treated as trusted.

Workaround

There is no known workaround at this time.

Resolution

All OpenSSH users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-misc/openssh-4.7"