The ssh_packet_read_poll2 function in packet.c in OpenSSH before 7.1p2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted network traffic.

Shayan Sadigh discovered that OpenSSH incorrectly handled environment files when the UseLogin feature is enabled. A local attacker could use this issue to gain privileges. (CVE-2015-8325)

Ben Hawkes discovered that OpenSSH incorrectly handled certain network traffic. A remote attacker could possibly use this issue to cause OpenSSH to crash, resulting in a denial of service. This issue only applied to Ubuntu 15.10. (CVE-2016-1907)

Thomas Hoger discovered that OpenSSH incorrectly handled untrusted X11 forwarding when the SECURITY extension is disabled. A connection configured as being untrusted could get switched to trusted in certain scenarios, contrary to expectations. (CVE-2016-1908)

It was discovered that OpenSSH incorrectly handled certain X11 forwarding data. A remote authenticated attacker could possibly use this issue to bypass certain intended command restrictions.
(CVE-2016-3115).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of OpenSSH running on the remote host is 6.x equal to or greater than 6.8p1 or 7.x prior to 7.1p2. It is, therefore, affected by a denial of service vulnerability due to an out-of-bounds read error that occurs when handling packets. A remote attacker can exploit this to crash the service or disclose memory contents.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2016-0777

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Sync with latest openssh package.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of OpenSSH prior to 7.1p2 are affected by multiple vulnerabilities:

 - Using a specially crafted SSH server, a context-dependent attacker can disclose sensitive memory contents when the client authenticates to the server, such as the client's private SSH keys. (CVE-2016-0777)
 - An unspecified overflow condition exists that is triggered as user-supplied input is not properly validated. With a specially crafted SSH server, a context-dependent attacker can cause a buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2016-0778)

Note: NNM has solely relied on the banner of the SSH client to perform this check. Any backported patches or workarounds such as recompiling or edited configurations are not observable through the banner.
 - A vulnerability exists that allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted network traffic. (CVE-2016-1907)

ID	Name	Product	Family	Severity
91086	Ubuntu 14.04 LTS : OpenSSH vulnerabilities (USN-2966-1)	Nessus	Ubuntu Local Security Checks	critical
90924	OpenSSH 6.8p1 - 7.x < 7.1p2 ssh_packet_read_poll2() Packet Handling DoS	Nessus	Misc.	medium
89610	Fedora 22 : openssh-6.9p1-10.fc22 (2016-c330264861)	Nessus	Fedora Local Security Checks	medium
89505	Fedora 22 : gsi-openssh-6.9p1-7.fc22 (2016-2e89eba0c1)	Nessus	Fedora Local Security Checks	high
88464	Fedora 23 : gsi-openssh-7.1p2-1.fc23 (2016-4556904561)	Nessus	Fedora Local Security Checks	high
9055	OpenSSH < 7.1p2 Multiple Vulnerabilities	Nessus Network Monitor	SSH	medium

Detections

Analytics

CVE-2016-1907

medium

Tenable Plugins

critical

medium

medium

high

high

medium