CVE-2016-1908

The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.

CVSS v3.0 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3.0 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1298741	Issue Tracking Patch Third Party Advisory
https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c	Patch
http://www.openssh.com/txt/release-7.2	Release Notes Vendor Advisory
http://openwall.com/lists/oss-security/2016/01/15/13	Mailing List Third Party Advisory
http://www.securityfocus.com/bid/84427	Third Party Advisory VDB Entry
https://security.gentoo.org/glsa/201612-18
http://www.securitytracker.com/id/1034705
http://rhn.redhat.com/errata/RHSA-2016-0741.html
http://rhn.redhat.com/errata/RHSA-2016-0465.html
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html

Configurations

Configuration 1 (hide)

cpe:2.3:a:openbsd:openssh:*:p2:*:*:*:*:*:*

Information

Published : 2017-04-11 18:59

Updated : 2018-09-11 10:29

NVD link : CVE-2016-1908

Mitre link : CVE-2016-1908

JSON object : View

Products Affected

openbsd

openssh

CWE

CWE-254

7PK - Security Features

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1298741", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1298741", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c", "name": "https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://www.openssh.com/txt/release-7.2", "name": "http://www.openssh.com/txt/release-7.2", "tags": ["Release Notes", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://openwall.com/lists/oss-security/2016/01/15/13", "name": "[oss-security] 20160115 Re: Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "http://www.securityfocus.com/bid/84427", "name": "84427", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "https://security.gentoo.org/glsa/201612-18", "name": "GLSA-201612-18", "tags": [], "refsource": "GENTOO"}, {"url": "http://www.securitytracker.com/id/1034705", "name": "1034705", "tags": [], "refsource": "SECTRACK"}, {"url": "http://rhn.redhat.com/errata/RHSA-2016-0741.html", "name": "RHSA-2016:0741", "tags": [], "refsource": "REDHAT"}, {"url": "http://rhn.redhat.com/errata/RHSA-2016-0465.html", "name": "RHSA-2016:0465", "tags": [], "refsource": "REDHAT"}, {"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html", "name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html", "tags": [], "refsource": "CONFIRM"}, {"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html", "name": "[debian-lts-announce] 20180910 [SECURITY] [DLA 1500-1] openssh security update", "tags": [], "refsource": "MLIST"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-254"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2016-1908", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}}, "publishedDate": "2017-04-11T18:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:openbsd:openssh:*:p2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "7.1"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-09-11T10:29Z"}