Description
Unspecified vulnerability in the sshd Privilege Separation Monitor in OpenSSH before 4.5 causes weaker verification that authentication has been successful, which might allow attackers to bypass authentication. NOTE: as of 20061108, it is believed that this issue is only exploitable by leveraging vulnerabilities in the unprivileged process, which are not known to exist.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssh | 1:4.3p2-6 | — |
| Debian 13 | openssh | 1:4.3p2-6 | — |
| Debian 12 | openssh | 1:4.3p2-6 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | openssh +4 | 3.9p1-8.RHEL4.17.1 | RHSA-2006:0738 |
| RHEL 3 | openssh +4 | 3.6.1p2-33.30.13 | RHSA-2006:0738 |
Advisories 1
- RHSA-2006:0738 Red Hat Security Advisory: openssh security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 1017183 vdb-entry
- http://sourceforge.net/project/shownotes.php?release_id=461854&group_id=69227
- 22932 third-party-advisory
- 22773 third-party-advisory
- http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html
- http://sourceforge.net/project/shownotes.php?release_id=461863&group_id=69227
- https://issues.rpath.com/browse/RPL-766
- 22872 third-party-advisory
- 22772 third-party-advisory
- ADV-2006-4399 vdb-entry
- 23513 third-party-advisory
- 23680 third-party-advisory
- SUSE-SR:2006:026 vendor-advisory
- 24055 third-party-advisory
- 22771 third-party-advisory
- openssh-separation-verificaton-weakness(30120) vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2007-048.htm
- ADV-2006-4400 vdb-entry
- 20061109 rPSA-2006-0207-1 openssh openssh-client openssh-server mailing-list
- 22778 third-party-advisory
- 22814 third-party-advisory
- oval:org.mitre.oval:def:11840 vdb-entry signature
- 20956 vdb-entry
- MDKSA-2006:204 vendor-advisory
- http://www.openssh.org/txt/release-4.5
- OpenPKG-SA-2006.032 vendor-advisory
- http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html
- RHSA-2006:0738 vendor-advisory