http://linuxtoday.com/news_story.php3?ltsn=2001-02-10-010-20-SC-SW There is a hole in classic ssh and openssh < 2.3. Best advice is to upgrade to openssh 2.3.