I just saw this in bugtraq this morning, and somebody already filed a bug against ssh. A patch is available against 2.2.0, so we probably need to backport it to 1.2.3. As it is heavily used among security- aware users, we need this one fixed soon. -- Chuan-kai Lin