This update for openssh fixes several issues. These security issues were fixed :

  - CVE-2016-8858: The kex_input_kexinit function in kex.c     allowed remote attackers to cause a denial of service     (memory consumption) by sending many duplicate KEXINIT     requests (bsc#1005480).

  - CVE-2016-10012: The shared memory manager (associated     with pre-authentication compression) did not ensure that     a bounds check is enforced by all compilers, which might     allowed local users to gain privileges by leveraging     access to a sandboxed privilege-separation process,     related to the m_zback and m_zlib data structures     (bsc#1016370).

  - CVE-2016-10009: Untrusted search path vulnerability in     ssh-agent.c allowed remote attackers to execute     arbitrary local PKCS#11 modules by leveraging control     over a forwarded agent-socket (bsc#1016366).

  - CVE-2016-10010: When forwarding unix domain sockets with     privilege separation disabled, the resulting sockets     have be created as 'root' instead of the authenticated     user. Forwarding unix domain sockets without privilege     separation enabled is now rejected.

  - CVE-2016-10011: authfile.c in sshd did not properly     consider the effects of realloc on buffer contents,     which might allowed local users to obtain sensitive     private-key information by leveraging access to a     privilege-separated child process (bsc#1016369).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Detections

Analytics

SUSE SLED12 / SLES12 Security Update : openssh (SUSE-SU-2017:0264-1)

high Nessus Plugin ID 96718

Version 3.8