CVE-2016-10009high
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.
References
http://packetstormsecurity.com/files/140261/OpenSSH-Arbitrary-Library-Loading.html
http://www.openwall.com/lists/oss-security/2016/12/19/2
http://www.securityfocus.com/bid/94968
http://www.securitytracker.com/id/1037490
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637
https://access.redhat.com/errata/RHSA-2017:2029
https://bugs.chromium.org/p/project-zero/issues/detail?id=1009
https://github.com/openbsd/src/commit/9476ce1dd37d3c3218d5640b74c34c65e5f4efe5
https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html
https://security.FreeBSD.org/advisories/FreeBSD-SA-17:01.openssh.asc
https://security.netapp.com/advisory/ntap-20171130-0002/
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us
https://usn.ubuntu.com/3538-1/
Details
Source: MITRE
Published: 2017-01-05
Updated: 2018-09-11
Type: CWE-426
Risk Information
CVSS v2
Base Score: 7.5
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Impact Score: 6.4
Exploitability Score: 10
Severity: HIGH
CVSS v3
Base Score: 7.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Impact Score: 3.4
Exploitability Score: 3.9
Severity: HIGH
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* versions up to 7.3 (inclusive)
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 148681 | Juniper Junos OS Multiple Vulnerabilities (JSA11169) | Nessus | Junos Local Security Checks | high |
| 136324 | AIX OpenSSH Advisory : openssh_advisory10.asc | Nessus | AIX Local Security Checks | high |
| 130514 | Juniper JSA10940 | Nessus | Junos Local Security Checks | high |
| 126510 | Juniper Junos Space < 18.2R1 Multiple Vulnerabilities (JSA10880) | Nessus | Junos Local Security Checks | high |
| 121665 | Photon OS 1.0: Openssh PHSA-2017-0001 | Nessus | PhotonOS Local Security Checks | high |
| 119697 | F5 Networks BIG-IP : OpenSSH vulnerability (K31440025) | Nessus | F5 Networks Local Security Checks | high |
| 111850 | Photon OS 1.0: Libxml2 / Linux / Openssh PHSA-2017-0001 (deprecated) | Nessus | PhotonOS Local Security Checks | high |
| 106503 | pfSense < 2.3.3 Multiple Vulnerabilities (SA-17_01 - SA-17_03) | Nessus | Firewalls | critical |
| 106266 | Ubuntu 14.04 LTS / 16.04 LTS / 17.10 : openssh vulnerabilities (USN-3538-1) | Nessus | Ubuntu Local Security Checks | high |
| 103650 | Amazon Linux AMI : openssh (ALAS-2017-898) | Nessus | Amazon Linux Local Security Checks | high |
| 102751 | CentOS 7 : openssh (CESA-2017:2029) | Nessus | CentOS Local Security Checks | high |
| 102650 | Scientific Linux Security Update : openssh on SL7.x x86_64 (20170801) | Nessus | Scientific Linux Local Security Checks | high |
| 102296 | Oracle Linux 7 : openssh (ELSA-2017-2029) | Nessus | Oracle Linux Local Security Checks | high |
| 102112 | RHEL 7 : openssh (RHSA-2017:2029) | Nessus | Red Hat Local Security Checks | high |
| 99900 | EulerOS 2.0 SP1 : openssh (EulerOS-SA-2017-1055) | Nessus | Huawei Local Security Checks | high |
| 99899 | EulerOS 2.0 SP2 : openssh (EulerOS-SA-2017-1054) | Nessus | Huawei Local Security Checks | high |
| 99134 | macOS 10.12.x < 10.12.4 Multiple Vulnerabilities (httpoxy) | Nessus | MacOS X Local Security Checks | critical |
| 97716 | openSUSE Security Update : openssh (openSUSE-2017-339) | Nessus | SuSE Local Security Checks | high |
| 97653 | SUSE SLES12 Security Update : openssh (SUSE-SU-2017:0607-3) | Nessus | SuSE Local Security Checks | high |
| 97652 | SUSE SLED12 Security Update : openssh (SUSE-SU-2017:0607-2) | Nessus | SuSE Local Security Checks | high |
| 97571 | SUSE SLES12 Security Update : openssh (SUSE-SU-2017:0607-1) | Nessus | SuSE Local Security Checks | high |
| 97570 | SUSE SLES11 Security Update : openssh (SUSE-SU-2017:0606-1) | Nessus | SuSE Local Security Checks | high |
| 97549 | SUSE SLES11 Security Update : openssh (SUSE-SU-2017:0603-1) | Nessus | SuSE Local Security Checks | high |
| 96919 | openSUSE Security Update : openssh (openSUSE-2017-184) | Nessus | SuSE Local Security Checks | high |
| 96718 | SUSE SLED12 / SLES12 Security Update : openssh (SUSE-SU-2017:0264-1) | Nessus | SuSE Local Security Checks | high |
| 96411 | FreeBSD : FreeBSD -- OpenSSH multiple vulnerabilities (2c948527-d823-11e6-9171-14dae9d210b8) | Nessus | FreeBSD Local Security Checks | high |
| 96358 | Fedora 25 : openssh (2017-4767e2991d) | Nessus | Fedora Local Security Checks | high |
| 9855 | OpenSSH 7.x < 7.4 Multiple Vulnerabilities | Nessus Network Monitor | SSH | high |
| 96151 | OpenSSH < 7.4 Multiple Vulnerabilities | Nessus | Misc. | high |
| 96116 | FreeBSD : openssh -- multiple vulnerabilities (2aedd15f-ca8b-11e6-a9a5-b499baebfeaf) | Nessus | FreeBSD Local Security Checks | high |
| 96091 | Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : openssh (SSA:2016-358-02) | Nessus | Slackware Local Security Checks | high |