crítica
CVE-2016-1908
openssh: possible fallback from untrusted to trusted X11 forwarding
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.9AV:N/AC:M/Au:S/C:P/I:P/A:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (media), Amazon (media), Oracle (media), Ubuntu (baja).
Descripción
The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| amazon linux 1 | openssh, openssh-clients, openssh-debuginfo y 4 más | 6.6.1p1-25.61.amzn1 y 1 más |
| debian 11 | openssh | 1:7.2p1-1 |
| debian 12 | openssh | 1:7.2p1-1 |
| debian 13 | openssh | 1:7.2p1-1 |
| debian 14 | openssh | 1:7.2p1-1 |
| debian 7 | openssh | sin corrección indicada |
| debian 8 | openssh | 1:6.7p1-5+deb8u6 |
| echo | openssh | 1:7.2p1-1 |
| Oracle Linux 6 | openssh, openssh-askpass, openssh-clients y 3 más | 5.3p1-117.el6 y 1 más |
| Oracle Linux 7 | openssh, openssh-askpass, openssh-clients y 5 más | 6.6.1p1-25.el7_2 y 1 más |
| root.io debian 11 | rootio-openssh | 1:7.2p1-1 |
| root.io debian 12 | rootio-openssh | 1:7.2p1-1 |
Mostrar las 37 entradas de 18 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| amazon linux 1 | openssh | 6.6.1p1-25.61.amzn1 |
| amazon linux 1 | openssh-clients | 6.6.1p1-25.61.amzn1 |
| amazon linux 1 | openssh-debuginfo | 6.6.1p1-25.61.amzn1 |
| amazon linux 1 | openssh-keycat | 6.6.1p1-25.61.amzn1 |
| amazon linux 1 | openssh-ldap | 6.6.1p1-25.61.amzn1 |
| amazon linux 1 | openssh-server | 6.6.1p1-25.61.amzn1 |
| amazon linux 1 | pam_ssh_agent_auth | 0.9.3-9.25.61.amzn1 |
| debian 11 | openssh | 1:7.2p1-1 |
| debian 12 | openssh | 1:7.2p1-1 |
| debian 13 | openssh | 1:7.2p1-1 |
| debian 14 | openssh | 1:7.2p1-1 |
| debian 7 | openssh | sin corrección indicada |
| debian 8 | openssh | 1:6.7p1-5+deb8u6 |
| echo | openssh | 1:7.2p1-1 |
| Oracle Linux 6 | openssh | 5.3p1-117.el6 |
| Oracle Linux 6 | openssh-askpass | 5.3p1-117.el6 |
| Oracle Linux 6 | openssh-clients | 5.3p1-117.el6 |
| Oracle Linux 6 | openssh-ldap | 5.3p1-117.el6 |
| Oracle Linux 6 | openssh-server | 5.3p1-117.el6 |
| Oracle Linux 6 | pam_ssh_agent_auth | 0.9.3-117.el6 |
| Oracle Linux 7 | openssh | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | openssh-askpass | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | openssh-clients | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | openssh-keycat | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | openssh-ldap | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | openssh-server | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | openssh-server-sysvinit | 6.6.1p1-25.el7_2 |
| Oracle Linux 7 | pam_ssh_agent_auth | 0.9.3-9.25.el7_2 |
| root.io debian 11 | rootio-openssh | 1:7.2p1-1 |
| root.io debian 12 | rootio-openssh | 1:7.2p1-1 |
| root.io debian 13 | rootio-openssh | 1:7.2p1-1 |
| seal Red Hat 6 | openssh | 5.3p1-124.el6_10+sp999 |
| seal Red Hat 6 | seal-openssh | 5.3p1-124.el6_10+sp999 |
| ubuntu 12.04 | openssh | 1:5.9p1-5ubuntu1.9 |
| ubuntu 14.04 | openssh | 1:6.6p1-2ubuntu2.7 |
| ubuntu 14.04-ESM | openssh | 1:6.6p1-2ubuntu2.7 |
| ubuntu 15.10 | openssh | 1:6.9p1-2ubuntu0.2 |
Referencias
- http://openwall.com/lists/oss-security/2016/01/15/13
- http://rhn.redhat.com/errata/RHSA-2016-0465.html
- http://rhn.redhat.com/errata/RHSA-2016-0741.html
- http://seclists.org/oss-sec/2016/q1/115
- http://www.openssh.com/txt/release-7.2
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.securityfocus.com/bid/84427
- http://www.securitytracker.com/id/1034705
Las 21 referencias
- https://access.redhat.com/security/cve/CVE-2016-1908
- https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c
- https://bugzilla.redhat.com/show_bug.cgi?id=1298741
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- https://linux.oracle.com/cve/CVE-2016-1908.html
- https://linux.oracle.com/errata/ELSA-2016-0741.html
- https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html
- https://lists.mindrot.org/pipermail/openssh-unix-dev/2016-January/034684.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-1908
- https://security.gentoo.org/glsa/201612-18
- https://thejh.net/written-stuff/openssh-6.8-xsecurity
- https://ubuntu.com/security/notices/USN-2966-1
- https://www.cve.org/CVERecord?id=CVE-2016-1908