OpenSSH: client bugs CVE-2016-0777 and CVE-2016-0778
by from OpenBSD Journal on (#10NPN)
This is the most serious bug you'll hear about this week: the issues identified and fixed in OpenSSH are dubbed CVE-2016-0777 and CVE-2016-0778.
An early heads up came from Theo de Raadt in this mailing list posting.
Until you are able to patch affected systems, the recommended workaround is to use
# echo -e 'Host *\nUseRoaming no' >> /etc/ssh/ssh_config
That is, add the option UseRoaming no to your /etc/ssh/ssh_config (or your user's ~/.ssh/config) file, or start your ssh client with -oUseRoaming=no included on the commandline.
We will be updating this article with more information as it becomes available.Read more...