CVE-2016-0778 The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly ma...
HighCVSS 8.1
EPSS 20.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/openssh(Debian:12) | < 1:7.1p2-1 | 1:7.1p2-1 |
| debian/openssh(Debian:13) | < 1:7.1p2-1 | 1:7.1p2-1 |
| debian/openssh(Debian:14) | < 1:7.1p2-1 | 1:7.1p2-1 |
| oracle linux | = 7 | No fix listed |
| oracle solaris | = 11.3 | No fix listed |
| OpenBSD openssh | = 5.4 | No fix listed |
| OpenBSD openssh | = 5.4-p1 | No fix listed |
| OpenBSD openssh | = 5.5 | No fix listed |
| OpenBSD openssh | = 5.5-p1 | No fix listed |
| OpenBSD openssh | = 5.6 | No fix listed |
| OpenBSD openssh | = 5.6-p1 | No fix listed |
| OpenBSD openssh | = 5.7 | No fix listed |
| OpenBSD openssh | = 5.7-p1 | No fix listed |
| OpenBSD openssh | = 5.8 | No fix listed |
| OpenBSD openssh | = 5.8-p1 | No fix listed |
| OpenBSD openssh | = 5.9 | No fix listed |
| OpenBSD openssh | = 5.9-p1 | No fix listed |
| OpenBSD openssh | = 6.0 | No fix listed |
| OpenBSD openssh | = 6.0-p1 | No fix listed |
| OpenBSD openssh | = 6.1 | No fix listed |
| OpenBSD openssh | = 6.1-p1 | No fix listed |
| OpenBSD openssh | = 6.2 | No fix listed |
| OpenBSD openssh | = 6.2-p1 | No fix listed |
| OpenBSD openssh | = 6.2-p2 | No fix listed |
| OpenBSD openssh | = 6.3 | No fix listed |
Show 22 more
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenBSD openssh | = 6.3-p1 | No fix listed |
| OpenBSD openssh | = 6.4 | No fix listed |
| OpenBSD openssh | = 6.4-p1 | No fix listed |
| OpenBSD openssh | = 6.5 | No fix listed |
| OpenBSD openssh | = 6.5-p1 | No fix listed |
| OpenBSD openssh | = 6.6 | No fix listed |
| OpenBSD openssh | = 6.6-p1 | No fix listed |
| OpenBSD openssh | = 6.7 | No fix listed |
| OpenBSD openssh | = 6.7-p1 | No fix listed |
| OpenBSD openssh | = 6.8 | No fix listed |
| OpenBSD openssh | = 6.8-p1 | No fix listed |
| OpenBSD openssh | = 6.9 | No fix listed |
| OpenBSD openssh | = 6.9-p1 | No fix listed |
| OpenBSD openssh | = 7.0 | No fix listed |
| OpenBSD openssh | = 7.0-p1 | No fix listed |
| OpenBSD openssh | = 7.1 | No fix listed |
| OpenBSD openssh | = 7.1-p1 | No fix listed |
| apple mac os x | >= 10.9.0, <= 10.9.5 | No fix listed |
| apple mac os x | >= 10.10.0, <= 10.10.5 | No fix listed |
| apple mac os x | >= 10.11.0, <= 10.11.3 | No fix listed |
| HP Inc virtual customer access system | <= 15.07 | No fix listed |
| sophos unified threat management software | = 9.353 | No fix listed |
References
- Debian Security Tracker CVE-2016-0778 vendor-advisory
- kb.juniper.net third-party-advisory
- APPLE-SA-2016-03-21-5 mailing-list release-notes third-party-advisory vendor-advisory
- FEDORA-2016-2e89eba0c1 mailing-list third-party-advisory vendor-advisory
- FEDORA-2016-4556904561 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:0117 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:0118 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:0119 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:0120 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2016:0127 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2016:0128 mailing-list third-party-advisory vendor-advisory
- packetstormsecurity.com third-party-advisory vdb-entry
- 20160115 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 mailing-list third-party-advisory
- DSA-3446 third-party-advisory vendor-advisory
- www.openssh.com patch release-notes vendor-advisory
- [oss-security] 20160114 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 exploit mailing-list technical-description third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- 20160114 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 mailing-list third-party-advisory vdb-entry
- 80698 third-party-advisory vdb-entry
- 1034671 third-party-advisory vdb-entry
- USN-2869-1 third-party-advisory vendor-advisory
- blogs.sophos.com release-notes vendor-advisory
- blogs.sophos.com release-notes vendor-advisory
- bto.bluecoat.com third-party-advisory
- cert-portal.siemens.com
- h20566.www2.hpe.com third-party-advisory
- h20566.www2.hpe.com third-party-advisory
- h20566.www2.hpe.com third-party-advisory
- h20566.www2.hpe.com third-party-advisory
- GLSA-201601-01 third-party-advisory vendor-advisory
- support.apple.com vendor-advisory