CVE-2015-5352

What it actually does

Missing refusal deadline validation in x11_open_helper allows X11 connection establishment outside the permitted time window when ForwardX11Trusted is disabled, bypassing intended access controls on forwarded X sessions.

Why it matters to the business

Attackers can obtain unauthorized graphical session access on systems using X11 forwarding, increasing risk of credential theft or lateral movement; the issue affects a widely deployed component with thousands of downstream dependents and has remained unpatched in many environments for years.

How an attack unfolds

An attacker initiates an SSH session requesting X11 forwarding without trusted mode, then issues an X connection request after the normal refusal deadline; because the deadline check is absent, the server accepts the late connection and grants access to the X11 channel.

How to fix it

Upgrade OpenSSH to version 6.9 or later on all affected systems; if immediate upgrade is impossible, disable X11 forwarding entirely via sshd_config until patched.

How to confirm the fix worked

Confirm OpenSSH version is 6.9 or newer via ssh -V; test X11 forwarding behavior with ForwardX11Trusted disabled to verify late connections are refused; review sshd_config for X11 forwarding settings.

Typical attack path

1. Establish SSH connection with X11 forwarding requested and ForwardX11Trusted disabled
2. Wait for or force the normal X11 refusal time window to expire
3. Send crafted X connection request that would normally be rejected
4. Obtain unauthorized X11 channel due to absent deadline enforcement

How to detect it

Examine sshd logs for X11 channel open requests that occur after normal refusal windows; correlate with authentication timestamps to identify connections accepted outside expected time bounds; review any historical X11 forwarding events on unpatched systems.

What your security team should do

• Prioritize upgrade to OpenSSH 6.9+ across all servers within 30 days given long exposure window
• Audit and disable X11 forwarding where not strictly required
• Add version checks to vulnerability scanning and asset inventory processes
• Monitor for any remaining pre-6.9 instances and isolate them until updated