Critical Severity Vulnerability
This vulnerability has been rated as Critical severity. Immediate action is recommended.
CVE-2016-1908
Critical
Low
Medium
High
Critical
9.8
CVSS Score
Vulnerability Description
The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.
CVSS Metrics
Common Vulnerability Scoring System
Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
N
Attack Complexity
L
Privileges Required
N
User Interaction
N
Scope
U
Confidentiality
H
Integrity
H
Availability
H
Known Affected Software
24 configuration(s) from 3 vendor(s)
debian_linux
Version:
8.0
CPE:
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
linux
Version:
7
CPE:
cpe:2.3:o:oracle:linux:7:8:*:*:*:*:*:*
linux
Version:
6
CPE:
cpe:2.3:o:oracle:linux:6:10:*:*:*:*:*:*
enterprise_linux_eus
Version:
7.5
CPE:
cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*
enterprise_linux_workstation
Version:
7.0
CPE:
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:x64:*
enterprise_linux_server_aus
Version:
7.4
CPE:
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
enterprise_linux_eus
Version:
7.2
CPE:
cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:*
enterprise_linux_server
Version:
6.0
CPE:
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:x86:*
enterprise_linux_server_tus
Version:
7.6
CPE:
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
enterprise_linux_eus
Version:
7.6
CPE:
cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*
enterprise_linux_eus
Version:
7.7
CPE:
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
enterprise_linux_server
Version:
7.0
CPE:
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:x64:*
enterprise_linux_server_tus
Version:
7.2
CPE:
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*
enterprise_linux_eus
Version:
7.3
CPE:
cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*
enterprise_linux_eus
Version:
7.4
CPE:
cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*
enterprise_linux_server_aus
Version:
7.6
CPE:
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
enterprise_linux_server_aus
Version:
7.3
CPE:
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
enterprise_linux_desktop
Version:
7.0
CPE:
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:x64:*
enterprise_linux_server_aus
Version:
7.7
CPE:
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
enterprise_linux_server_aus
Version:
7.2
CPE:
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
enterprise_linux_desktop
Version:
6.0
CPE:
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:x64:*
enterprise_linux_server_tus
Version:
7.3
CPE:
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*
enterprise_linux_server_tus
Version:
7.7
CPE:
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
enterprise_linux_workstation
Version:
6.0
CPE:
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:x86:*
This vulnerability affects 24 software configuration(s). Ensure you patch all affected systems.
References & Resources
-
http://openwall.com/lists/oss-security/2016/01/15/13secalert@redhat.com Mailing List Third Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2016-0465.htmlsecalert@redhat.com Third Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2016-0741.htmlsecalert@redhat.com Third Party Advisory
-
http://www.openssh.com/txt/release-7.2secalert@redhat.com Release Notes Vendor Advisory
-
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlsecalert@redhat.com Third Party Advisory
-
http://www.securityfocus.com/bid/84427secalert@redhat.com Third Party Advisory VDB Entry
-
http://www.securitytracker.com/id/1034705secalert@redhat.com Broken Link Third Party Advisory VDB Entry
-
https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416csecalert@redhat.com Patch Third Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=1298741secalert@redhat.com Issue Tracking Patch Third Party Advisory
-
https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfsecalert@redhat.com
-
https://lists.debian.org/debian-lts-announce/2018/09/msg00010.htmlsecalert@redhat.com Mailing List Third Party Advisory
-
https://security.gentoo.org/glsa/201612-18secalert@redhat.com Third Party Advisory
-
http://openwall.com/lists/oss-security/2016/01/15/13af854a3a-2127-422b-91ae-364da2661108 Mailing List Third Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2016-0465.htmlaf854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2016-0741.htmlaf854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
http://www.openssh.com/txt/release-7.2af854a3a-2127-422b-91ae-364da2661108 Release Notes Vendor Advisory
-
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlaf854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
http://www.securityfocus.com/bid/84427af854a3a-2127-422b-91ae-364da2661108 Third Party Advisory VDB Entry
-
http://www.securitytracker.com/id/1034705af854a3a-2127-422b-91ae-364da2661108 Broken Link Third Party Advisory VDB Entry
-
https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416caf854a3a-2127-422b-91ae-364da2661108 Patch Third Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=1298741af854a3a-2127-422b-91ae-364da2661108 Issue Tracking Patch Third Party Advisory
-
https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfaf854a3a-2127-422b-91ae-364da2661108
-
https://lists.debian.org/debian-lts-announce/2018/09/msg00010.htmlaf854a3a-2127-422b-91ae-364da2661108 Mailing List Third Party Advisory
-
https://security.gentoo.org/glsa/201612-18af854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
Severity Details
9.8
out of 10.0
Critical
Weakness Type (CWE)
CWE-287
Top 25 #10
Improper Authentication
- Description
- When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- Exploit Likelihood
- High
- Typical Severity
- High
- OWASP Top 10
- A07:2021-Identification/Auth Failures
- Abstraction Level
- Class
Key Information
- Published Date
- April 11, 2017
