Description
OpenSSH 3.6.1 and earlier, when restricting host access by numeric IP addresses and with VerifyReverseMapping disabled, allows remote attackers to bypass "from=" and "user@host" address restrictions by connecting to a host from a system whose reverse DNS hostname contains the numeric IP address.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssh | 1:3.8p1-1 | — |
| Debian 13 | openssh | 1:3.8p1-1 | — |
| Debian 12 | openssh | 1:3.8p1-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | openssh +4 | 3.6.1p2-33.30.9 | RHSA-2006:0298 |
| RHEL 2 | openssh +4 | 3.1p1-21 | RHSA-2006:0698 |
Advisories 2
- RHSA-2006:0698 Red Hat Security Advisory: openssh security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0298 Red Hat Security Advisory: openssh security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html
- RHSA-2006:0298 vendor-advisory
- 23680 third-party-advisory
- VU#978316 third-party-advisory
- oval:org.mitre.oval:def:9894 vdb-entry signature
- http://lists.apple.com/mhonarc/security-announce/msg00038.html
- 7831 vdb-entry
- 21262 third-party-advisory
- 21129 third-party-advisory
- 20030605 OpenSSH remote clent address restriction circumvention mailing-list
- 21724 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-174.htm
- http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html
- 22196 third-party-advisory
- RHSA-2006:0698 vendor-advisory