The OpenSSH project today reported a client side issue affecting OpenSSH
versions 5.4 - 7.1. This issue could allow an SSH client to leak key
information, potentially exposing users to man-in-the-middle attacks.
What does this mean?
A key exchange is initiated when an SSH client connects to a server. A new
"roaming" feature included in the OpenSSH client can be exploited and a
malicious server could use this issue to leak client memory to the server,
including private client user keys.
Who is affected?
This issue affects the OpenSSH client (not server) on most modern operating
systems including Linux, FreeBSD and Mac OSX. This issue may also affect
users running OpenSSH for Windows but does not affect users using PuTTY on
Windows.
That means you don't have to update OpenSSH on your Droplet (the server
side), but you should update the OpenSSH client on your local computer. If
you want to cover all your bases, you could generate new key pairs and
upload the new public keys to your servers (see the second-to-last section
for details).
How to fix the isssue
While patches and updates are being rolled out for affected distributions,
the feature causing this security issue can be disabled manually in order
to resolve the issue. On OS X, Linux and BSD variants this can be done by
adding a line to your SSH configuration.
On Linux and FreeBSD
Run the following command to add the new line to your configuration:
echo 'UseRoaming no' | sudo tee -a /etc/ssh/ssh_config
On Mac OSX
Run the following command to add the new line to your configuration:
echo "UseRoaming no" >> ~/.ssh/config
--
Danishka Navin
http://danishkanavin.blogspot.com
http://twitter.com/danishkanavin
http://www.flickr.com/photos/danishkanavin/