[Secure-testing-team] Bug#796599: openssh-client: ssh -G no longer returns "illegal option" (6.0) or "unknown option" (6.7)

[Francois Marier]

Package: openssh-client
Version: 1:6.9p1-1
Severity: critical
Tags: security
Justification: root security hole

Sorry for the alarmist bug report. Hopefully this is a false positive and it
can be reassigned to chkrootkit, but just in case...

The "ssh -G" test [1] for Linux  output has changed:

  on wheezy (openssh 6.0), it was: ssh: illegal option -- G
  on jessie (openssh 6.7), it was: unknown option -- G

and now on 6.9, there's nothing except the normal usage info.

Is this a sign of Linux Ebury? Or (hopefully) a genuine change in the output
which now invalidates this simple rootkit test?

Francois

[1] https://lwn.net/Articles/591023/

-- System Information:
Debian Release: stretch/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 4.1.0-2-amd64 (SMP w/4 CPU cores)
Locale: LANG=fr_CA.utf8, LC_CTYPE=fr_CA.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages openssh-client depends on:
ii  adduser           3.113+nmu3
ii  dpkg              1.18.2
ii  libc6             2.19-19
ii  libedit2          3.1-20150325-1
ii  libgssapi-krb5-2  1.13.2+dfsg-2
ii  libselinux1       2.3-2+b1
ii  libssl1.0.0       1.0.2d-1
ii  passwd            1:4.2-3
ii  zlib1g            1:1.2.8.dfsg-2+b1

Versions of packages openssh-client recommends:
ii  xauth  1:1.0.9-1

Versions of packages openssh-client suggests:
pn  keychain      <none>
pn  libpam-ssh    <none>
pn  monkeysphere  <none>
ii  ssh-askpass   1:1.2.4.1-9

-- Configuration Files:
/etc/ssh/ssh_config changed [not included]

-- no debconf information

-- 
http://fmarier.org/