# MA-588.032016: MyCERT Advisory - OpenSSH Client Vulnerability

**Date:** 12 Mar 2016  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-588.032016  
**Advisory ID:** MA-588.032016

---

####
**1.0     Introduction**
OpenSSH is the premier connectivity tool for remote login with the SSH protocol. It encrypts all traffic to eliminate eavesdropping, connection hijacking, and other attacks. OpenSSH version 7.2p2 has been released to address a vulnerability in all prior versions. Users and administrators are encouraged to review the OpenSSH Security Advisory and apply the necessary update.
**2.0     Impact**
Exploitation of one of these vulnerabilities may allow a remote attacker to obtain sensitive information from an affected system.
**3.0    Affected Products**
All versions of OpenSSH prior to 7.2p2 with X11Forwarding enabled.
**4.0    Recommendation**
MyCERT highly recommends users of these applications to upgrade to the latest version of the affected products. The following updates are available:
**4.1 Portable OpenSSH 7.2p2**
Contains a fix for this vulnerability.  Patches for supported OpenBSD releases (5.7, 5.8 and 5.9) have been committed to the -STABLE branches and are available on the errata pages:      
•    <http://www.openbsd.org/errata57.html>
•    <http://www.openbsd.org/errata58.html>
•    <http://www.openbsd.org/errata59.html>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#11726873746328282851726873746362747264637865683f7c68) or [[email protected]](/cdn-cgi/l/email-protection#a1ccd8c2c4d3d5e1ccd8c2c4d3d58fced3c68fccd8)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0     References**
•    OpenSSH Security Release:  
<https://www.us-cert.gov/ncas/current-activity/2016/03/11/OpenSSH-Releases-Security-Update>
•    OpenSSH Security Advisory: x11fwd.adv
<http://www.openssh.com/txt/x11fwd.adv>
•    OpenSSH: Execute arbitrary code/commands - Existing account    
<https://www.auscert.org.au/render.html?it=32322>