# MA-559.012016: MyCERT Advisory - OpenSSH Client Vulnerability

**Date:** 15 Jan 2016  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-559.012016  
**Advisory ID:** MA-559.012016

---

####
**1.0     Introduction**
OpenSSH version 7.1p2 has been released to address vulnerabilities in versions 5.4 through 7.1p1. Users and administrators are encouraged to review the OpenSSH Release Notes and Vulnerability Note VU#456088 and apply the necessary update.
**2.0     Impact**
A user that authenticates to a malicious or compromised server may reveal private data, including the user's private SSH key, or cause a buffer overflow that may lead to remote code execution in certain non-default configurations.
Exploitation of one of these vulnerabilities may allow a remote attacker to obtain sensitive information from an affected system.
**3.0    Affected Products**
The affected OpenSSH Client is OpenSSH client code versions 5.4 through 7.1p1.
**4.0    Recommendation**
MyCERT highly recommended users of these applications to upgrade to the latest version of the affected products. The following updates are available:
4.1 Apply an update
OpenSSH 7.1p2 has released to address these issues. Affected users are recommended to update as soon as possible.
•    http://www.openssh.com/txt/release-7.1p2
4.2 If update is currently not an option, you may consider the following workaround:
•    WorkDisable the 'UseRoaming' Feature
The vulnerable code in the client can be completely disabled by adding 'UseRoaming no' to the global ssh\_config(5) file, or to user configuration in ~/.ssh/config, or by passing -oUseRoaming=no on the command line.
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#65061c0700175c5c5c25061c07001716000610170c111c4b081c) or [[email protected]](/cdn-cgi/l/email-protection#ea8793898f989eaa8793898f989ec485988dc48793) 
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0     References**
•    OpenSSH Client Vulnerability
<https://www.us-cert.gov/ncas/current-activity/2016/01/14/OpenSSH-Client-Vulnerability>
•    Vulnerability Note VU#456088
<https://www.kb.cert.org/vuls/id/456088>
•    OpenSSH Release Notes
<http://www.openssh.com/txt/release-7.1p2>