[security-alerts] FW: [SA22173] OpenSSH Signal Handling Vulnerability

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> 
> TITLE:
> OpenSSH Signal Handling Vulnerability
> 
> SECUNIA ADVISORY ID:
> SA22173
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/22173/
> 
> CRITICAL:
> Highly critical
> 
> IMPACT:
> DoS, System access
> 
> WHERE:
> From remote
> 
> SOFTWARE:
> OpenSSH 3.x
> http://secunia.com/product/101/
> OpenSSH 4.x
> http://secunia.com/product/5653/
> 
> DESCRIPTION:
> Mark Dowd reported a vulnerability in OpenSSH, which can be exploited
> by malicious people to cause a DoS (Denial of Service) and potentially
> compromise of a vulnerable system.
> 
> The vulnerability is caused due to a race condition within the signal
> handling. This can be exploited to crash the OpenSSH server and
> potentially allows the execution of arbitrary code.
> 
> The vulnerability has been reported in version 4.3. Prior versions
> may also be affected.
> 
> SOLUTION:
> Update to OpenSSH 4.4.
> 
> PROVIDED AND/OR DISCOVERED BY:
> Mark Dowd
> 
> ORIGINAL ADVISORY:
> http://openssh.org/txt/release-4.4
> 
> OTHER REFERENCES:
> http://rhn.redhat.com/errata/RHSA-2006-0697.html
>