GLSA-200711-02 : OpenSSH: Security bypass
High Nessus Plugin ID 27612
SynopsisThe remote Gentoo host is missing one or more security-related patches.
DescriptionThe remote host is affected by the vulnerability described in GLSA-200711-02 (OpenSSH: Security bypass)
Jan Pechanec discovered that OpenSSH uses a trusted X11 cookie when it cannot create an untrusted one.
An attacker could bypass the SSH client security policy and gain privileges by causing an X client to be treated as trusted.
There is no known workaround at this time.
SolutionAll OpenSSH users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=net-misc/openssh-4.7'