The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.

The remote NewStart CGSL host, running version MAIN 4.05, has openssh-latest packages installed that are affected by multiple vulnerabilities:

  - scp in OpenSSH 4.2p1 allows attackers to execute     arbitrary commands via filenames that contain shell     metacharacters or spaces, which are expanded twice.
    (CVE-2006-0225)

  - sshd in OpenSSH before 4.4, when using the version 1 SSH     protocol, allows remote attackers to cause a denial of     service (CPU consumption) via an SSH packet that     contains duplicate blocks, which is not properly handled     by the CRC compensation attack detector. (CVE-2006-4924)

  - Signal handler race condition in OpenSSH before 4.4     allows remote attackers to cause a denial of service     (crash), and possibly execute arbitrary code if GSSAPI     authentication is enabled, via unspecified vectors that     lead to a double-free. (CVE-2006-5051)

  - Unspecified vulnerability in the sshd Privilege     Separation Monitor in OpenSSH before 4.5 causes weaker     verification that authentication has been successful,     which might allow attackers to bypass authentication.
    NOTE: as of 20061108, it is believed that this issue is     only exploitable by leveraging vulnerabilities in the     unprivileged process, which are not known to exist.
    (CVE-2006-5794)

  - Unspecified vulnerability in the     linux_audit_record_event function in OpenSSH 4.3p2, as     used on Fedora Core 6 and possibly other systems, allows     remote attackers to write arbitrary characters to an     audit log via a crafted username. NOTE: some of these     details are obtained from third party information.
    (CVE-2007-3102)

  - The (1) remote_glob function in sftp-glob.c and the (2)     process_put function in sftp.c in OpenSSH 5.8 and     earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2,     OpenBSD 4.7, and other products, allow remote     authenticated users to cause a denial of service (CPU     and memory consumption) via crafted glob expressions     that do not match any pathnames, as demonstrated by glob     expressions in SSH_FXP_STAT requests to an sftp daemon,     a different vulnerability than CVE-2010-2632.
    (CVE-2010-4755)

  - The default configuration of OpenSSH through 6.1     enforces a fixed time limit between establishing a TCP     connection and completing a login, which makes it easier     for remote attackers to cause a denial of service     (connection-slot exhaustion) by periodically making many     new TCP connections. (CVE-2010-5107)

  - It was found that OpenSSH did not properly handle     certain AcceptEnv parameter values with wildcard     characters. A remote attacker could use this flaw to     bypass intended environment variable restrictions.
    (CVE-2014-2532)

  - It was discovered that OpenSSH clients did not correctly     verify DNS SSHFP records. A malicious server could use     this flaw to force a connecting client to skip the DNS     SSHFP record check and require the user to perform     manual host verification of the DNS SSHFP record.
    (CVE-2014-2653)

  - It was found that when OpenSSH was used in a Kerberos     environment, remote authenticated users were allowed to     log in as a different user if they were listed in the     ~/.k5users file of that user, potentially bypassing     intended authentication restrictions. (CVE-2014-9278)

  - It was discovered that the OpenSSH sshd daemon did not     check the list of keyboard-interactive authentication     methods for duplicates. A remote attacker could use this     flaw to bypass the MaxAuthTries limit, making it easier     to perform password guessing attacks. (CVE-2015-5600)

  - It was discovered that the OpenSSH sshd daemon fetched     PAM environment settings before running the login     program. In configurations with UseLogin=yes and the     pam_env PAM module configured to read user environment     settings, a local user could use this flaw to execute     arbitrary code as root. (CVE-2015-8325)

  - An information leak flaw was found in the way the     OpenSSH client roaming feature was implemented. A     malicious server could potentially use this flaw to leak     portions of memory (possibly including private SSH keys)     of a successfully authenticated OpenSSH client.
    (CVE-2016-0777)

  - An access flaw was discovered in OpenSSH; the OpenSSH     client did not correctly handle failures to generate     authentication cookies for untrusted X11 forwarding. A     malicious or compromised remote X application could     possibly use this flaw to establish a trusted connection     to the local X server, even if only untrusted X11     forwarding was requested. (CVE-2016-1908)

  - A covert timing channel flaw was found in the way     OpenSSH handled authentication of non-existent users. A     remote unauthenticated attacker could possibly use this     flaw to determine valid user names by measuring the     timing of server responses. (CVE-2016-6210)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that the OpenSSH server did not     sanitize data received in requests to enable X11     forwarding. An authenticated client with restricted SSH     access could possibly use this flaw to bypass intended     restrictions. (CVE-2016-3115)

  - An access flaw was discovered in OpenSSH the OpenSSH     client did not correctly handle failures to generate     authentication cookies for untrusted X11 forwarding. A     malicious or compromised remote X application could     possibly use this flaw to establish a trusted     connection to the local X server, even if only     untrusted X11 forwarding was requested. (CVE-2016-1908)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201612-18 (OpenSSH: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenSSH. Please review       the CVE identifiers referenced below for details.
  Impact :

    Remote attackers could cause Denial of Service and conduct user       enumeration.
  Workaround :

    There is no known workaround at this time.

This update for OpenSSH fixes the following issues :

  - Prevent user enumeration through the timing of password     processing. (bsc#989363, CVE-2016-6210)

  - Allow lowering the DH groups parameter limit in server     as well as when GSSAPI key exchange is used.
    (bsc#948902)

  - Sanitize input for xauth(1). (bsc#970632, CVE-2016-3115)

  - Prevent X11 SECURITY circumvention when forwarding X11     connections. (bsc#962313, CVE-2016-1908)

  - Disable DH parameters under 2048 bits by default and     allow lowering the limit back to the RFC 4419 specified     minimum through an option. (bsc#932483, bsc#948902)

  - Ignore PAM environment when using login. (bsc#975865,     CVE-2015-8325)

  - Limit the accepted password length (prevents a possible     denial of service). (bsc#992533, CVE-2016-6515)

  - Relax version requires for the openssh-askpass     sub-package. (bsc#962794)

  - Avoid complaining about unset DISPLAY variable.
    (bsc#981654)

  - Initialize message id to prevent connection breakups in     some cases. (bsc#959096)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

openssh was updated to fix three security issues.

These security issues were fixed :

  - CVE-2016-3115: Multiple CRLF injection vulnerabilities     in session.c in sshd in OpenSSH allowed remote     authenticated users to bypass intended shell-command     restrictions via crafted X11 forwarding data, related to     the (1) do_authenticated1 and (2) session_x11_req     functions (bsc#970632).

  - CVE-2016-1908: Possible fallback from untrusted to     trusted X11 forwarding (bsc#962313).

  - CVE-2015-8325: Ignore PAM environment vars when     UseLogin=yes (bsc#975865).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - It was found that the OpenSSH client did not properly     enforce the ForwardX11Timeout setting. A malicious or     compromised remote X application could possibly use this     flaw to establish a trusted connection to the local X     server, even if only untrusted X11 forwarding was     requested. (CVE-2015-5352)

  - A flaw was found in the way OpenSSH handled PAM     authentication when using privilege separation. An     attacker with valid credentials on the system and able     to fully compromise a non-privileged pre-authentication     process using a different flaw could use this flaw to     authenticate as other users. (CVE-2015-6563)

  - A use-after-free flaw was found in OpenSSH. An attacker     able to fully compromise a non-privileged     pre-authentication process using a different flaw could     possibly cause sshd to crash or execute arbitrary code     with root privileges. (CVE-2015-6564)

  - An access flaw was discovered in OpenSSH; the OpenSSH     client did not correctly handle failures to generate     authentication cookies for untrusted X11 forwarding. A     malicious or compromised remote X application could     possibly use this flaw to establish a trusted connection     to the local X server, even if only untrusted X11     forwarding was requested. (CVE-2016-1908)

This update for OpenSSH fixes three security issues.

These security issues were fixed :

  - CVE-2016-3115: Sanitise input for xauth(1) (bsc#970632)

  - CVE-2016-1908: Prevent X11 SECURITY circumvention when     forwarding X11 connections (bsc#962313)

  - CVE-2015-8325: Ignore PAM environment when using login     (bsc#975865)

These non-security issues were fixed :

  - Fix help output of sftp (bsc#945493)

  - Restarting openssh with openssh-fips installed was not     working correctly (bsc#945484)

  - Fix crashes when /proc is not available in the chroot     (bsc#947458)

  - Correctly parse GSSAPI KEX algorithms (bsc#961368)

  - More verbose FIPS mode/CC related documentation in     README.FIPS (bsc#965576, bsc#960414)

  - Fix PRNG re-seeding (bsc#960414, bsc#729190)

  - Disable DH parameters under 2048 bits by default and     allow lowering the limit back to the RFC 4419 specified     minimum through an option (bsc#932483, bsc#948902)

This update was imported from the SUSE:SLE-12:Update update project.

This update for OpenSSH fixes three security issues.

These security issues were fixed :

  - CVE-2016-3115: Sanitise input for xauth(1) (bsc#970632)

  - CVE-2016-1908: Prevent X11 SECURITY circumvention when     forwarding X11 connections (bsc#962313)

  - CVE-2015-8325: Ignore PAM environment when using login     (bsc#975865)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for openssh is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

Security Fix(es) :

* It was found that the OpenSSH client did not properly enforce the ForwardX11Timeout setting. A malicious or compromised remote X application could possibly use this flaw to establish a trusted connection to the local X server, even if only untrusted X11 forwarding was requested. (CVE-2015-5352)

* A flaw was found in the way OpenSSH handled PAM authentication when using privilege separation. An attacker with valid credentials on the system and able to fully compromise a non-privileged pre-authentication process using a different flaw could use this flaw to authenticate as other users. (CVE-2015-6563)

* A use-after-free flaw was found in OpenSSH. An attacker able to fully compromise a non-privileged pre-authentication process using a different flaw could possibly cause sshd to crash or execute arbitrary code with root privileges. (CVE-2015-6564)

* An access flaw was discovered in OpenSSH; the OpenSSH client did not correctly handle failures to generate authentication cookies for untrusted X11 forwarding. A malicious or compromised remote X application could possibly use this flaw to establish a trusted connection to the local X server, even if only untrusted X11 forwarding was requested. (CVE-2016-1908)

For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.8 Release Notes and Red Hat Enterprise Linux 6.8 Technical Notes linked from the References section.

From Red Hat Security Advisory 2016:0741 :

An update for openssh is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

Security Fix(es) :

* It was found that the OpenSSH client did not properly enforce the ForwardX11Timeout setting. A malicious or compromised remote X application could possibly use this flaw to establish a trusted connection to the local X server, even if only untrusted X11 forwarding was requested. (CVE-2015-5352)

* A flaw was found in the way OpenSSH handled PAM authentication when using privilege separation. An attacker with valid credentials on the system and able to fully compromise a non-privileged pre-authentication process using a different flaw could use this flaw to authenticate as other users. (CVE-2015-6563)

* A use-after-free flaw was found in OpenSSH. An attacker able to fully compromise a non-privileged pre-authentication process using a different flaw could possibly cause sshd to crash or execute arbitrary code with root privileges. (CVE-2015-6564)

* An access flaw was discovered in OpenSSH; the OpenSSH client did not correctly handle failures to generate authentication cookies for untrusted X11 forwarding. A malicious or compromised remote X application could possibly use this flaw to establish a trusted connection to the local X server, even if only untrusted X11 forwarding was requested. (CVE-2016-1908)

For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.8 Release Notes and Red Hat Enterprise Linux 6.8 Technical Notes linked from the References section.

Shayan Sadigh discovered that OpenSSH incorrectly handled environment files when the UseLogin feature is enabled. A local attacker could use this issue to gain privileges. (CVE-2015-8325)

Ben Hawkes discovered that OpenSSH incorrectly handled certain network traffic. A remote attacker could possibly use this issue to cause OpenSSH to crash, resulting in a denial of service. This issue only applied to Ubuntu 15.10. (CVE-2016-1907)

Thomas Hoger discovered that OpenSSH incorrectly handled untrusted X11 forwarding when the SECURITY extension is disabled. A connection configured as being untrusted could get switched to trusted in certain scenarios, contrary to expectations. (CVE-2016-1908)

It was discovered that OpenSSH incorrectly handled certain X11 forwarding data. A remote authenticated attacker could possibly use this issue to bypass certain intended command restrictions.
(CVE-2016-3115).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0741 advisory.

  - openssh: XSECURITY restrictions bypass under certain conditions in ssh(1) (CVE-2015-5352)

  - openssh: Privilege separation weakness related to PAM support (CVE-2015-6563)

  - openssh: Use-after-free bug related to PAM support (CVE-2015-6564)

  - openssh: possible fallback from untrusted to trusted X11 forwarding (CVE-2016-1908)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AIX host has a version of OpenSSH installed that is affected by the following vulnerabilities :

  - A remote code execution vulnerability exists in the     sshd server component of OpenSSH due to improper     sanitization of X11 authentication credentials. An     authenticated, remote attacker can exploit this     vulnerability to inject arbitrary xauth commands.
    (CVE-2016-3115)

  - A security bypass vulnerability exists in the sshd     server component of OpenSSH due to improper error     handling. An authenticated, remote attacker can exploit     this vulnerability, when an authentication cookie is     generated during untrusted X11 forwarding, to gain     access to the X server on the host system.
    (CVE-2016-1908)

OpenSSH contains a flaw in ssh(1) that is triggered when it falls back from untrusted X11 forwarding to trusted forwarding when the X server disables the SECURITY extension. This may potentially result in X11 connections not being trusted.

Note: NNM has solely relied on the banner of the SSH client to perform this check. Any backported patches or workarounds such as recompiling or edited configurations are not observable through the banner.

An access flaw was discovered in the OpenSSH client where it did not correctly handle failures to generate authentication cookies for untrusted X11 forwarding. A malicious or compromised remote X application could possibly use this flaw to establish a trusted connection to the local X server, even if only untrusted X11 forwarding was requested.

It was discovered that the OpenSSH server did not sanitize data received in requests to enable X11 forwarding. An authenticated client with restricted SSH access could possibly use this flaw to bypass intended restrictions. (CVE-2016-3115)

An access flaw was discovered in OpenSSH; the OpenSSH client did not correctly handle failures to generate authentication cookies for untrusted X11 forwarding. A malicious or compromised remote X application could possibly use this flaw to establish a trusted connection to the local X server, even if only untrusted X11 forwarding was requested. (CVE-2016-1908)

After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

Updated openssh packages that fix two security issues are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

OpenSSH is OpenBSD's SSH (Secure Shell) protocol implementation. These packages include the core files necessary for both the OpenSSH client and server.

It was discovered that the OpenSSH server did not sanitize data received in requests to enable X11 forwarding. An authenticated client with restricted SSH access could possibly use this flaw to bypass intended restrictions. (CVE-2016-3115)

An access flaw was discovered in OpenSSH; the OpenSSH client did not correctly handle failures to generate authentication cookies for untrusted X11 forwarding. A malicious or compromised remote X application could possibly use this flaw to establish a trusted connection to the local X server, even if only untrusted X11 forwarding was requested. (CVE-2016-1908)

All openssh users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

From Red Hat Security Advisory 2016:0465 :

Updated openssh packages that fix two security issues are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

OpenSSH is OpenBSD's SSH (Secure Shell) protocol implementation. These packages include the core files necessary for both the OpenSSH client and server.

It was discovered that the OpenSSH server did not sanitize data received in requests to enable X11 forwarding. An authenticated client with restricted SSH access could possibly use this flaw to bypass intended restrictions. (CVE-2016-3115)

An access flaw was discovered in OpenSSH; the OpenSSH client did not correctly handle failures to generate authentication cookies for untrusted X11 forwarding. A malicious or compromised remote X application could possibly use this flaw to establish a trusted connection to the local X server, even if only untrusted X11 forwarding was requested. (CVE-2016-1908)

All openssh users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

According to its banner, the version of OpenSSH running on the remote host is prior to 7.2. It is, therefore, affected by a security bypass vulnerability due to a flaw in ssh(1) that is triggered when it falls back from untrusted X11 forwarding to trusted forwarding when the SECURITY extension is disabled by the X server. This can result in untrusted X11 connections that can be exploited by a remote attacker.

Sync with latest openssh package.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
701160	OpenSSH < 7.2 Input Validation Error	Nessus Network Monitor	SSH	critical
127415	NewStart CGSL MAIN 4.05 : openssh-latest Multiple Vulnerabilities (NS-SA-2019-0146)	Nessus	NewStart CGSL Local Security Checks	critical
99771	EulerOS 2.0 SP1 : openssh (EulerOS-SA-2016-1008)	Nessus	Huawei Local Security Checks	critical
95604	GLSA-201612-18 : OpenSSH: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
93735	SUSE SLES11 Security Update : openssh (SUSE-SU-2016:2388-1)	Nessus	SuSE Local Security Checks	critical
91655	SUSE SLES11 Security Update : openssh (SUSE-SU-2016:1528-1)	Nessus	SuSE Local Security Checks	critical
91540	Scientific Linux Security Update : openssh on SL6.x i386/x86_64 (20160510)	Nessus	Scientific Linux Local Security Checks	critical
91413	openSUSE Security Update : openssh (openSUSE-2016-668)	Nessus	SuSE Local Security Checks	critical
91318	SUSE SLED12 / SLES12 Security Update : openssh (SUSE-SU-2016:1386-1)	Nessus	SuSE Local Security Checks	critical
91166	CentOS 6 : openssh (CESA-2016:0741)	Nessus	CentOS Local Security Checks	critical
91148	Oracle Linux 6 : openssh (ELSA-2016-0741)	Nessus	Oracle Linux Local Security Checks	critical
91086	Ubuntu 14.04 LTS : OpenSSH vulnerabilities (USN-2966-1)	Nessus	Ubuntu Local Security Checks	critical
91073	RHEL 6 : openssh (RHSA-2016:0741)	Nessus	Red Hat Local Security Checks	critical
90942	AIX OpenSSH Advisory : openssh_advisory8.asc	Nessus	AIX Local Security Checks	medium
9311	OpenSSH < 7.2 X11Forwarding Fallback Bypass Vulnerability	Nessus Network Monitor	SSH	medium
90268	Amazon Linux AMI : openssh (ALAS-2016-675)	Nessus	Amazon Linux Local Security Checks	critical
90081	Scientific Linux Security Update : openssh on SL7.x x86_64 (20160321)	Nessus	Scientific Linux Local Security Checks	critical
90078	RHEL 7 : openssh (RHSA-2016:0465)	Nessus	Red Hat Local Security Checks	critical
90074	Oracle Linux 7 : openssh (ELSA-2016-0465)	Nessus	Oracle Linux Local Security Checks	critical
90068	CentOS 7 : openssh (CESA-2016:0465)	Nessus	CentOS Local Security Checks	critical
90022	OpenSSH < 7.2 Untrusted X11 Forwarding Fallback Security Bypass	Nessus	Misc.	critical
89528	Fedora 23 : gsi-openssh-7.1p2-3.fc23 (2016-4509765b4b)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2016-1908

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium

medium

critical

critical

critical

critical

critical

critical

critical