2016-03-22
ALT-BU-2016-2660-1
Branch p6 update bulletin.
Closed vulnerabilities
Published: 2016-03-22
BDU:2016-00819
Уязвимости средства криптографической защиты OpenSSH, позволяющие нарушителю обойти ограничения интерпретатора команд
Severity: MEDIUM (5.5)
References:
Published: 2016-03-22
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2016-3115
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.
Severity: MEDIUM (6.4)
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
References:
- http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/session.c
- http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/session.c
- http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/session.c.diff?r1=1.281&r2=1.282&f=h
- http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/session.c.diff?r1=1.281&r2=1.282&f=h
- FEDORA-2016-fc1cc33e05
- FEDORA-2016-fc1cc33e05
- FEDORA-2016-188267b485
- FEDORA-2016-188267b485
- FEDORA-2016-bb59db3c86
- FEDORA-2016-bb59db3c86
- FEDORA-2016-0bcab055a7
- FEDORA-2016-0bcab055a7
- FEDORA-2016-d339d610c1
- FEDORA-2016-d339d610c1
- FEDORA-2016-08e5803496
- FEDORA-2016-08e5803496
- http://packetstormsecurity.com/files/136234/OpenSSH-7.2p1-xauth-Command-Injection-Bypass.html
- http://packetstormsecurity.com/files/136234/OpenSSH-7.2p1-xauth-Command-Injection-Bypass.html
- RHSA-2016:0465
- RHSA-2016:0465
- RHSA-2016:0466
- RHSA-2016:0466
- 20160314 CVE-2016-3115 - OpenSSH <=7.2p1 xauth injection
- 20160314 CVE-2016-3115 - OpenSSH <=7.2p1 xauth injection
- 20160314 CVE-2016-3116 - Dropbear SSH xauth injection
- 20160314 CVE-2016-3116 - Dropbear SSH xauth injection
- http://www.openssh.com/txt/x11fwd.adv
- http://www.openssh.com/txt/x11fwd.adv
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- 84314
- 84314
- 1035249
- 1035249
- https://bto.bluecoat.com/security-advisory/sa121
- https://bto.bluecoat.com/security-advisory/sa121
- https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115
- https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115
- [debian-lts-announce] 20180910 [SECURITY] [DLA 1500-1] openssh security update
- [debian-lts-announce] 20180910 [SECURITY] [DLA 1500-1] openssh security update
- GLSA-201612-18
- GLSA-201612-18
- 39569
- 39569
- FreeBSD-SA-16:14
- FreeBSD-SA-16:14