|
COMMAND OpenSSH defect in the BSD_AUTH access control handling SYSTEMS AFFECTED OpenSSH 3.2.2 PROBLEM Reported as bug \"OpenBSD PR 2659\", - there is a defect in the BSD_AUTH access control handling for OpenBSD and BSD/OS systems: Under certain conditions, on systems using YP with netgroups in the password database, it is possible that sshd does ACL checks for the requested user name but uses the password database entry of a different user for authentication. This means that denied users might authenticate successfully while permitted users could be locked out (OpenBSD PR 2659). SOLUTION Upgrade to OpenSSH 3.2.3