----------------------------------------------------------------------

A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI
has been released. The new version includes many new and advanced
features, which makes it even easier to stay patched.

Download and test it today:
https://psi.secunia.com/

Read more about this new version:
https://psi.secunia.com/?page=changelog

----------------------------------------------------------------------

TITLE:
OpenSSH X11 Forwarding Information Disclosure Vulnerability

SECUNIA ADVISORY ID:
SA29522

VERIFY ADVISORY:
http://secunia.com/advisories/29522/

CRITICAL:
Less critical

IMPACT:
Exposure of sensitive information

WHERE:
Local system

SOFTWARE:
OpenSSH 4.x
http://secunia.com/product/5653/

DESCRIPTION:
A vulnerability has been discovered in OpenSSH, which can be
exploited by malicious, local users to disclose sensitive
information.

The vulnerability is caused due to sshd improperly binding TCP ports
on the local IPV6 interface if required ports on the IPV4 interface
are in use. This can be exploited by a malicious, local user to
intercept an X11 forwarding session by listening to a port used by
sshd to forward the local X11 display (e.g. port 6010/TCP).  

The vulnerability is reported in versions 4.3p2 and confirmed in
4.7p1. Other versions may also be affected.

SOLUTION:
Restrict local access to trusted users only.

Do not establish OpenSSH X11 forwarding sessions with untrusted
machines.

PROVIDED AND/OR DISCOVERED BY:
Reported by Timo Juhani Lindfors in a Debian bug report.

ORIGINAL ADVISORY:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=463011

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------