The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate KEXINIT requests. NOTE: a third party reports that "OpenSSH upstream does not consider this as a security issue."

The remote AIX host has a version of OpenSSH installed that is affected by the following vulnerabilities :

  - OpenSSH is vulnerable to a denial of service, caused by     an error in the kex_input_kexinit() function. By     sending specially crafted data during the key exchange     process, a remote attacker could exploit this     vulnerability to consume all available memory resources.
    (CVE-2016-8858)

  - OpenSSH could allow a remote authenticated attacker to     execute arbitrary code on the system, caused by the     loading of a specially crafted PKCS#11 module across a     forwarded agent channel. An attacker could exploit this     vulnerability to write files or execute arbitrary code     on the system. (CVE-2016-10009)

  - OpenSSH could allow a local authenticated attacker to     obtain sensitive information, caused by a privilege     separation flaw. An attacker could exploit this     vulnerability to obtain host private key material and     other sensitive information. (CVE-2016-10011)

  - OpenSSH could allow a local attacker to gain elevated     privileges on the system, caused by improper bounds     checking in the shared memory manager. An attacker     could exploit this vulnerability to gain elevated     privileges on the system. (CVE-2016-10012)

An update of the openssh package has been released.

According to its self-reported version number, the remote pfSense install is affected by multiple vulnerabilities as stated in the referenced vendor advisories.

According to its self-reported version number, the remote Junos device is affected by a denial of service vulnerability.

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The kex_input_kexinit function in kex.c in OpenSSH 6.x     and 7.x through 7.3 allows remote attackers to cause a     denial of service (memory consumption) by sending many     duplicate KEXINIT requests. NOTE: a third party reports     that 'OpenSSH upstream does not consider this as a     security issue.'(CVE-2016-8858)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssh fixes the following issues :

  - CVE-2016-8858: prevent resource depletion during key     exchange (bsc#1005480)

  - CVE-2016-10009: limit directories for loading PKCS11     modules to avoid privilege escalation (bsc#1016366)

  - CVE-2016-10011: Prevent possible leaks of host private     keys to low-privilege process handling authentication     (bsc#1016369)

  - Fix suggested command for removing conflicting server     keys from the known_hosts file (bsc#1006221)

  - Properly verify CIDR masks in the AllowUsers and     DenyUsers configuration lists (bsc#1005893)

This update was imported from the SUSE:SLE-12:Update update project.

This update for openssh fixes the following issues :

  - CVE-2016-8858: prevent resource depletion during key     exchange (bsc#1005480)

  - CVE-2016-10009: limit directories for loading PKCS11     modules to avoid privilege escalation (bsc#1016366)

  - CVE-2016-10011: Prevent possible leaks of host private     keys to low-privilege process handling authentication     (bsc#1016369)

  - Fix suggested command for removing conflicting server     keys from the known_hosts file (bsc#1006221)

  - Properly verify CIDR masks in the AllowUsers and     DenyUsers configuration lists (bsc#1005893)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssh fixes the following issues: Security issues fixed :

  - CVE-2016-8858: prevent resource depletion during key     exchange (bsc#1005480)

  - CVE-2016-10009: limit directories for loading PKCS11     modules to avoid privilege escalation (bsc#1016366)

  - CVE-2016-10011: Prevent possible leaks of host private     keys to low-privilege process handling authentication     (bsc#1016369) Non security issues fixed :

  - Properly verify CIDR masks in the AllowUsers and     DenyUsers configuration lists (bsc#1005893)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssh fixes the following issues: Security issues fixed :

  - CVE-2016-8858: prevent resource depletion during key     exchange (bsc#1005480)

  - CVE-2016-10009: limit directories for loading PKCS11     modules to avoid privilege escalation (bsc#1016366)

  - CVE-2016-10011: Prevent possible leaks of host private     keys to low-privilege process handling authentication     (bsc#1016369) Non security issues fixed :

  - Properly verify CIDR masks in the AllowUsers and     DenyUsers configuration lists (bsc#1005893)

  - fix suggested command for removing conflicting server     keys from the known_hosts file (bsc#1006221)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssh fixes several issues.

These security issues were fixed :

  - CVE-2016-8858: The kex_input_kexinit function in kex.c     allowed remote attackers to cause a denial of service     (memory consumption) by sending many duplicate KEXINIT     requests (bsc#1005480).

  - CVE-2016-10012: The shared memory manager (associated     with pre-authentication compression) did not ensure that     a bounds check is enforced by all compilers, which might     allowed local users to gain privileges by leveraging     access to a sandboxed privilege-separation process,     related to the m_zback and m_zlib data structures     (bsc#1016370).

  - CVE-2016-10009: Untrusted search path vulnerability in     ssh-agent.c allowed remote attackers to execute     arbitrary local PKCS#11 modules by leveraging control     over a forwarded agent-socket (bsc#1016366).

  - CVE-2016-10010: When forwarding unix domain sockets with     privilege separation disabled, the resulting sockets     have be created as 'root' instead of the authenticated     user. Forwarding unix domain sockets without privilege     separation enabled is now rejected.

  - CVE-2016-10011: authfile.c in sshd did not properly     consider the effects of realloc on buffer contents,     which might allowed local users to obtain sensitive     private-key information by leveraging access to a     privilege-separated child process (bsc#1016369).

These non-security issues were fixed :

  - Adjusted suggested command for removing conflicting     server keys from the known_hosts file (bsc#1006221)

  - Properly verify CIDR masks in configuration (bsc#1005893     bsc#1021626)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for openssh fixes several issues. These security issues were fixed :

  - CVE-2016-8858: The kex_input_kexinit function in kex.c     allowed remote attackers to cause a denial of service     (memory consumption) by sending many duplicate KEXINIT     requests (bsc#1005480).

  - CVE-2016-10012: The shared memory manager (associated     with pre-authentication compression) did not ensure that     a bounds check is enforced by all compilers, which might     allowed local users to gain privileges by leveraging     access to a sandboxed privilege-separation process,     related to the m_zback and m_zlib data structures     (bsc#1016370).

  - CVE-2016-10009: Untrusted search path vulnerability in     ssh-agent.c allowed remote attackers to execute     arbitrary local PKCS#11 modules by leveraging control     over a forwarded agent-socket (bsc#1016366).

  - CVE-2016-10010: When forwarding unix domain sockets with     privilege separation disabled, the resulting sockets     have be created as 'root' instead of the authenticated     user. Forwarding unix domain sockets without privilege     separation enabled is now rejected.

  - CVE-2016-10011: authfile.c in sshd did not properly     consider the effects of realloc on buffer contents,     which might allowed local users to obtain sensitive     private-key information by leveraging access to a     privilege-separated child process (bsc#1016369).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201612-18 (OpenSSH: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenSSH. Please review       the CVE identifiers referenced below for details.
  Impact :

    Remote attackers could cause Denial of Service and conduct user       enumeration.
  Workaround :

    There is no known workaround at this time.

When processing the SSH_MSG_KEXINIT message, the server could allocate up to a few hundreds of megabytes of memory per each connection, before any authentication take place. Impact : A remote attacker may be able to cause a SSH server to allocate an excessive amount of memory. Note that the default MaxStartups setting on FreeBSD will limit the effectiveness of this attack.

ID	Name	Product	Family	Severity
136324	AIX OpenSSH Advisory : openssh_advisory10.asc	Nessus	AIX Local Security Checks	high
121659	Photon OS 1.0: Openssh PHSA-2016-0014	Nessus	PhotonOS Local Security Checks	high
106503	pfSense < 2.3.3 Multiple Vulnerabilities (SA-17_01 - SA-17_03)	Nessus	Firewalls	critical
106394	Juniper Junos Key Exchange Initialization Handling Memory Exhaustion Remote DoS (JSA10837)	Nessus	Junos Local Security Checks	high
99852	EulerOS 2.0 SP1 : openssh (EulerOS-SA-2017-1006)	Nessus	Huawei Local Security Checks	high
97716	openSUSE Security Update : openssh (openSUSE-2017-339)	Nessus	SuSE Local Security Checks	high
97653	SUSE SLES12 Security Update : openssh (SUSE-SU-2017:0607-3)	Nessus	SuSE Local Security Checks	high
97652	SUSE SLED12 Security Update : openssh (SUSE-SU-2017:0607-2)	Nessus	SuSE Local Security Checks	high
97571	SUSE SLES12 Security Update : openssh (SUSE-SU-2017:0607-1)	Nessus	SuSE Local Security Checks	high
97570	SUSE SLES11 Security Update : openssh (SUSE-SU-2017:0606-1)	Nessus	SuSE Local Security Checks	high
97549	SUSE SLES11 Security Update : openssh (SUSE-SU-2017:0603-1)	Nessus	SuSE Local Security Checks	high
96919	openSUSE Security Update : openssh (openSUSE-2017-184)	Nessus	SuSE Local Security Checks	high
96718	SUSE SLED12 / SLES12 Security Update : openssh (SUSE-SU-2017:0264-1)	Nessus	SuSE Local Security Checks	high
95604	GLSA-201612-18 : OpenSSH: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
94418	FreeBSD : FreeBSD -- OpenSSH Remote Denial of Service vulnerability (6a2cfcdc-9dea-11e6-a298-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2016-8858

high

Tenable Plugins

high

high

critical

high

high

high

high

high

high

high

high

high

high

critical

high