CVE-2016-10009

HIGH

Description

Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.

References

http://packetstormsecurity.com/files/140261/OpenSSH-Arbitrary-Library-Loading.html

http://www.openwall.com/lists/oss-security/2016/12/19/2

http://www.securityfocus.com/bid/94968

http://www.securitytracker.com/id/1037490

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637

https://access.redhat.com/errata/RHSA-2017:2029

https://bugs.chromium.org/p/project-zero/issues/detail?id=1009

https://github.com/openbsd/src/commit/9476ce1dd37d3c3218d5640b74c34c65e5f4efe5

https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html

https://security.FreeBSD.org/advisories/FreeBSD-SA-17:01.openssh.asc

https://security.netapp.com/advisory/ntap-20171130-0002/

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us

https://usn.ubuntu.com/3538-1/

https://www.exploit-db.com/exploits/40963/

https://www.openssh.com/txt/release-7.4

Details

Source: MITRE

Published: 2017-01-05

Updated: 2018-09-11

Type: CWE-426

Risk Information

CVSS v2.0

Base Score: 7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 10

Severity: HIGH

CVSS v3.0

Base Score: 7.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Impact Score: 3.4

Exploitability Score: 3.9

Severity: HIGH

Tenable Plugins

View all (29 total)

ID	Name	Product	Family	Severity
130514	Juniper JSA10940	Nessus	Junos Local Security Checks	high
126510	Juniper Junos Space < 18.2R1 Multiple Vulnerabilities (JSA10880)	Nessus	Junos Local Security Checks	high
121665	Photon OS 1.0: Openssh PHSA-2017-0001	Nessus	PhotonOS Local Security Checks	high
119697	F5 Networks BIG-IP : OpenSSH vulnerability (K31440025)	Nessus	F5 Networks Local Security Checks	high
111850	Photon OS 1.0: Libxml2 / Linux / Openssh PHSA-2017-0001 (deprecated)	Nessus	PhotonOS Local Security Checks	high
106503	pfSense < 2.3.3 Multiple Vulnerabilities (SA-17_01 - SA-17_03)	Nessus	Firewalls	high
106266	Ubuntu 14.04 LTS / 16.04 LTS / 17.10 : openssh vulnerabilities (USN-3538-1)	Nessus	Ubuntu Local Security Checks	high
103650	Amazon Linux AMI : openssh (ALAS-2017-898)	Nessus	Amazon Linux Local Security Checks	high
102751	CentOS 7 : openssh (CESA-2017:2029)	Nessus	CentOS Local Security Checks	high
102650	Scientific Linux Security Update : openssh on SL7.x x86_64	Nessus	Scientific Linux Local Security Checks	high
102296	Oracle Linux 7 : openssh (ELSA-2017-2029)	Nessus	Oracle Linux Local Security Checks	high
102112	RHEL 7 : openssh (RHSA-2017:2029)	Nessus	Red Hat Local Security Checks	high
99900	EulerOS 2.0 SP1 : openssh (EulerOS-SA-2017-1055)	Nessus	Huawei Local Security Checks	high
99899	EulerOS 2.0 SP2 : openssh (EulerOS-SA-2017-1054)	Nessus	Huawei Local Security Checks	high
99134	macOS 10.12.x < 10.12.4 Multiple Vulnerabilities (httpoxy)	Nessus	MacOS X Local Security Checks	critical
97716	openSUSE Security Update : openssh (openSUSE-2017-339)	Nessus	SuSE Local Security Checks	high
97653	SUSE SLES12 Security Update : openssh (SUSE-SU-2017:0607-3)	Nessus	SuSE Local Security Checks	high
97652	SUSE SLED12 Security Update : openssh (SUSE-SU-2017:0607-2)	Nessus	SuSE Local Security Checks	high
97571	SUSE SLES12 Security Update : openssh (SUSE-SU-2017:0607-1)	Nessus	SuSE Local Security Checks	high
97570	SUSE SLES11 Security Update : openssh (SUSE-SU-2017:0606-1)	Nessus	SuSE Local Security Checks	high
97549	SUSE SLES11 Security Update : openssh (SUSE-SU-2017:0603-1)	Nessus	SuSE Local Security Checks	high
96919	openSUSE Security Update : openssh (openSUSE-2017-184)	Nessus	SuSE Local Security Checks	high
96718	SUSE SLED12 / SLES12 Security Update : openssh (SUSE-SU-2017:0264-1)	Nessus	SuSE Local Security Checks	high
96411	FreeBSD : FreeBSD -- OpenSSH multiple vulnerabilities (2c948527-d823-11e6-9171-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	high
96358	Fedora 25 : openssh (2017-4767e2991d)	Nessus	Fedora Local Security Checks	high
9855	OpenSSH 7.x < 7.4 Multiple Vulnerabilities	Nessus Network Monitor	SSH	medium
96151	OpenSSH < 7.4 Multiple Vulnerabilities	Nessus	Misc.	high
96116	FreeBSD : openssh -- multiple vulnerabilities (2aedd15f-ca8b-11e6-a9a5-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	high
96091	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : openssh (SSA:2016-358-02)	Nessus	Slackware Local Security Checks	high