kritisch
CVE-2016-1908
openssh: possible fallback from untrusted to trusted X11 forwarding
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.9AV:N/AC:M/Au:S/C:P/I:P/A:N
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Red Hat (mittel), Amazon (mittel), Oracle (mittel), Ubuntu (niedrig).
Beschreibung
The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| amazon linux 1 | openssh, openssh-clients, openssh-debuginfo und 4 weitere | 6.6.1p1-25.61.amzn1 und 1 weitere |
| debian 11 | openssh | 1:7.2p1-1 |
| debian 12 | openssh | 1:7.2p1-1 |
| debian 13 | openssh | 1:7.2p1-1 |
| debian 14 | openssh | 1:7.2p1-1 |
| debian 7 | openssh | kein Fix angegeben |
| debian 8 | openssh | 1:6.7p1-5+deb8u6 |
| echo | openssh | 1:7.2p1-1 |
| Oracle Linux 6 | openssh, openssh-askpass, openssh-clients und 3 weitere | 5.3p1-117.el6 und 1 weitere |
| Oracle Linux 7 | openssh, openssh-askpass, openssh-clients und 5 weitere | 6.6.1p1-25.el7_2 und 1 weitere |
| root.io debian 11 | rootio-openssh | 1:7.2p1-1 |
| root.io debian 12 | rootio-openssh | 1:7.2p1-1 |
Alle 37 Einträge aus 18 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| amazon linux 1 | openssh | 6.6.1p1-25.61.amzn1 |
| amazon linux 1 | openssh-clients | 6.6.1p1-25.61.amzn1 |
| amazon linux 1 | openssh-debuginfo | 6.6.1p1-25.61.amzn1 |
| amazon linux 1 | openssh-keycat | 6.6.1p1-25.61.amzn1 |
| amazon linux 1 | openssh-ldap | 6.6.1p1-25.61.amzn1 |
| amazon linux 1 | openssh-server | 6.6.1p1-25.61.amzn1 |
| amazon linux 1 | pam_ssh_agent_auth | 0.9.3-9.25.61.amzn1 |
| debian 11 | openssh | 1:7.2p1-1 |
| debian 12 | openssh | 1:7.2p1-1 |
| debian 13 | openssh | 1:7.2p1-1 |
| debian 14 | openssh | 1:7.2p1-1 |
| debian 7 | openssh | kein Fix angegeben |
| debian 8 | openssh | 1:6.7p1-5+deb8u6 |
| echo | openssh | 1:7.2p1-1 |
| Oracle Linux 6 | openssh | 5.3p1-117.el6 |
| Oracle Linux 6 | openssh-askpass | 5.3p1-117.el6 |
| Oracle Linux 6 | openssh-clients | 5.3p1-117.el6 |
| Oracle Linux 6 | openssh-ldap | 5.3p1-117.el6 |
| Oracle Linux 6 | openssh-server | 5.3p1-117.el6 |
| Oracle Linux 6 | pam_ssh_agent_auth | 0.9.3-117.el6 |
| Oracle Linux 7 | openssh | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | openssh-askpass | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | openssh-clients | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | openssh-keycat | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | openssh-ldap | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | openssh-server | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | openssh-server-sysvinit | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | pam_ssh_agent_auth | 0.9.3-9.25.el7_2 |
| root.io debian 11 | rootio-openssh | 1:7.2p1-1 |
| root.io debian 12 | rootio-openssh | 1:7.2p1-1 |
| root.io debian 13 | rootio-openssh | 1:7.2p1-1 |
| seal Red Hat 6 | openssh | 5.3p1-124.el6_10+sp999 |
| seal Red Hat 6 | seal-openssh | 5.3p1-124.el6_10+sp999 |
| ubuntu 12.04 | openssh | 1:5.9p1-5ubuntu1.9 |
| ubuntu 14.04 | openssh | 1:6.6p1-2ubuntu2.7 |
| ubuntu 14.04-ESM | openssh | 1:6.6p1-2ubuntu2.7 |
| ubuntu 15.10 | openssh | 1:6.9p1-2ubuntu0.2 |
Referenzen
- http://openwall.com/lists/oss-security/2016/01/15/13
- http://rhn.redhat.com/errata/RHSA-2016-0465.html
- http://rhn.redhat.com/errata/RHSA-2016-0741.html
- http://seclists.org/oss-sec/2016/q1/115
- http://www.openssh.com/txt/release-7.2
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.securityfocus.com/bid/84427
- http://www.securitytracker.com/id/1034705
Alle 21 Referenzen
- https://access.redhat.com/security/cve/CVE-2016-1908
- https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c
- https://bugzilla.redhat.com/show_bug.cgi?id=1298741
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- https://linux.oracle.com/cve/CVE-2016-1908.html
- https://linux.oracle.com/errata/ELSA-2016-0741.html
- https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html
- https://lists.mindrot.org/pipermail/openssh-unix-dev/2016-January/034684.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-1908
- https://security.gentoo.org/glsa/201612-18
- https://thejh.net/written-stuff/openssh-6.8-xsecurity
- https://ubuntu.com/security/notices/USN-2966-1
- https://www.cve.org/CVERecord?id=CVE-2016-1908