This advisory addresses a vulnerability present in the ssh software package that allows an attacker to execute arbitrary commands on the ssh server or otherwise subvert an encrypted ssh channel with arbitrary data.
All communications are automatically and transparently encrypted.
Encryption is also used for integrity checking purposes although current implementations rely on a 32 bit cyclic redundancy check to perform integrity checks after the decryption of an incoming packet. Encryption is done using one of a list of supported algorithms that is exchanged between client and server. Upon conection establishment client and server perform a protocol negotiation that includes mutual authentication, selection of a cipher supported by both ends for subsequent communications and of a session key to be used with the cipher. The attack is equally feasible on the server to client stream, although it just gives the ability to send arbitrary data the user's terminal. The encrypted portion of the packet has a length that is always a multiple of 8 bytes.