If X11forwarding is turned on, and remote xauth is patched, sshing into a compromised server can allow programs to be run on under your ssh client. This is turned on by default in ssh1, ssh2, and openssh.
083e386a21e2ee341ea8c6922e55896cde8a2b905b0e442bf586d17e95bf58d8