https://bugzilla.redhat.com/show_bug.cgi?id=1406278 It was found that when privilege separation was disabled in OpenSSH, forwarded Unix-domain sockets would be created by sshd with root privileges instead of the privileges of the authenticated user. This could allow an authenticated attacker to potentially gain root privileges on the host system. Note: privileges separation has been enabled by default since OpenSSH 3.3/3.3p1 (2002-06-21). Thus, OpenSSH in any version of RHEL is not affected by default. An affected OpenSSH configuration would have to specifically disable privilege separation with the "UsePrivilegeSeparation no" configuration directive in /etc/ssh/sshd_config. More information is also available in https://access.redhat.com/solutions/1354953 . CVE assignment: http://seclists.org/oss-sec/2016/q4/708 Upstream patch: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/serverloop.c.diff?r1=1.188&r2=1.189&sortby=date&f=h
