CVE-2016-0777 The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmissi...
MediumCVSS 6.5
EPSS 63.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/openssh(Debian:12) | < 1:7.1p2-1 | 1:7.1p2-1 |
| debian/openssh(Debian:13) | < 1:7.1p2-1 | 1:7.1p2-1 |
| debian/openssh(Debian:14) | < 1:7.1p2-1 | 1:7.1p2-1 |
| sophos unified threat management software | = 9.318 | No fix listed |
| sophos unified threat management software | = 9.353 | No fix listed |
| oracle linux | = 7 | No fix listed |
| oracle solaris | = 11.3 | No fix listed |
| OpenBSD openssh | = 5.0 | No fix listed |
| OpenBSD openssh | = 5.0-p1 | No fix listed |
| OpenBSD openssh | = 5.1 | No fix listed |
| OpenBSD openssh | = 5.1-p1 | No fix listed |
| OpenBSD openssh | = 5.2 | No fix listed |
| OpenBSD openssh | = 5.2-p1 | No fix listed |
| OpenBSD openssh | = 5.3 | No fix listed |
| OpenBSD openssh | = 5.3-p1 | No fix listed |
| OpenBSD openssh | = 5.4 | No fix listed |
| OpenBSD openssh | = 5.4-p1 | No fix listed |
| OpenBSD openssh | = 5.5 | No fix listed |
| OpenBSD openssh | = 5.5-p1 | No fix listed |
| OpenBSD openssh | = 5.6 | No fix listed |
| OpenBSD openssh | = 5.6-p1 | No fix listed |
| OpenBSD openssh | = 5.7 | No fix listed |
| OpenBSD openssh | = 5.7-p1 | No fix listed |
| OpenBSD openssh | = 5.8 | No fix listed |
| OpenBSD openssh | = 5.8-p1 | No fix listed |
Show 29 more
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenBSD openssh | = 5.9 | No fix listed |
| OpenBSD openssh | = 5.9-p1 | No fix listed |
| OpenBSD openssh | = 6.0 | No fix listed |
| OpenBSD openssh | = 6.0-p1 | No fix listed |
| OpenBSD openssh | = 6.1 | No fix listed |
| OpenBSD openssh | = 6.1-p1 | No fix listed |
| OpenBSD openssh | = 6.2 | No fix listed |
| OpenBSD openssh | = 6.2-p1 | No fix listed |
| OpenBSD openssh | = 6.2-p2 | No fix listed |
| OpenBSD openssh | = 6.3 | No fix listed |
| OpenBSD openssh | = 6.3-p1 | No fix listed |
| OpenBSD openssh | = 6.4 | No fix listed |
| OpenBSD openssh | = 6.4-p1 | No fix listed |
| OpenBSD openssh | = 6.5 | No fix listed |
| OpenBSD openssh | = 6.5-p1 | No fix listed |
| OpenBSD openssh | = 6.6 | No fix listed |
| OpenBSD openssh | = 6.6-p1 | No fix listed |
| OpenBSD openssh | = 6.7 | No fix listed |
| OpenBSD openssh | = 6.7-p1 | No fix listed |
| OpenBSD openssh | = 6.8 | No fix listed |
| OpenBSD openssh | = 6.8-p1 | No fix listed |
| OpenBSD openssh | = 6.9 | No fix listed |
| OpenBSD openssh | = 6.9-p1 | No fix listed |
| OpenBSD openssh | = 7.0 | No fix listed |
| OpenBSD openssh | = 7.0-p1 | No fix listed |
| OpenBSD openssh | = 7.1 | No fix listed |
| OpenBSD openssh | = 7.1-p1 | No fix listed |
| HP Inc remote device access virtual customer access system | <= 15.07 | No fix listed |
| apple mac os x | <= 10.11.3 | No fix listed |
References
- Debian Security Tracker CVE-2016-0777 vendor-advisory
- kb.juniper.net third-party-advisory
- APPLE-SA-2016-03-21-5 mailing-list third-party-advisory vendor-advisory
- FEDORA-2016-2e89eba0c1 mailing-list third-party-advisory vendor-advisory
- FEDORA-2016-67c6ef0d4f mailing-list third-party-advisory vendor-advisory
- FEDORA-2016-c330264861 mailing-list third-party-advisory vendor-advisory
- FEDORA-2016-4556904561 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:0117 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:0118 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:0119 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:0120 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2016:0127 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2016:0128 mailing-list third-party-advisory vendor-advisory
- packetstormsecurity.com third-party-advisory vdb-entry
- 20160115 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 mailing-list third-party-advisory
- DSA-3446 third-party-advisory vendor-advisory
- www.openssh.com vendor-advisory
- [oss-security] 20160114 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 mailing-list third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- 20160114 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 mailing-list third-party-advisory vdb-entry
- 80695 third-party-advisory vdb-entry
- 1034671 third-party-advisory vdb-entry
- USN-2869-1 third-party-advisory vendor-advisory
- blogs.sophos.com third-party-advisory
- blogs.sophos.com third-party-advisory
- bto.bluecoat.com third-party-advisory
- cert-portal.siemens.com
- h20566.www2.hpe.com third-party-advisory
- h20566.www2.hpe.com third-party-advisory
- h20566.www2.hpe.com third-party-advisory
- h20566.www2.hpe.com third-party-advisory
- FreeBSD-SA-16:07 third-party-advisory vendor-advisory
- GLSA-201601-01 third-party-advisory vendor-advisory
- support.apple.com third-party-advisory
- bugs.debian.org issue-tracking