CVE-2016-0778
High · 8.1CVSS
8.1
EPSS
20.9%
Published
Jan 14, 2016
CISA due date
—
The record
The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | openssh | 0 | 1:7.1p2-1 |
| Debian:12 | openssh | 0 | 1:7.1p2-1 |
| Debian:13 | openssh | 0 | 1:7.1p2-1 |
| Debian:14 | openssh | 0 | 1:7.1p2-1 |
| Debian:6.0 | openssh | 0 | 1:5.5p1-6+squeeze8 |
| Debian:7 | openssh | 0 | 1:6.0p1-4+deb7u3 |
| Debian:8 | openssh | 0 | 1:6.7p1-5+deb8u1 |
| Mageia:5 | openssh | 0 | 6.6p1-5.6.mga5 |
| Red Hat:enterprise_linux:7::client | openssh | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::client | openssh-askpass | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::client | openssh-clients | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::client | openssh-debuginfo | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::client | openssh-keycat | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::client | openssh-ldap | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::client | openssh-server | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::client | openssh-server-sysvinit | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::client | pam_ssh_agent_auth | 0 | 0:0.9.3-9.23.el7_2 |
| Red Hat:enterprise_linux:7::computenode | openssh | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::computenode | openssh-askpass | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::computenode | openssh-clients | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::computenode | openssh-debuginfo | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::computenode | openssh-keycat | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::computenode | openssh-ldap | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::computenode | openssh-server | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::computenode | openssh-server-sysvinit | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::computenode | pam_ssh_agent_auth | 0 | 0:0.9.3-9.23.el7_2 |
| Red Hat:enterprise_linux:7::server | openssh | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::server | openssh-askpass | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::server | openssh-clients | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::server | openssh-debuginfo | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::server | openssh-keycat | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::server | openssh-ldap | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::server | openssh-server | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::server | openssh-server-sysvinit | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::server | pam_ssh_agent_auth | 0 | 0:0.9.3-9.23.el7_2 |
| Red Hat:enterprise_linux:7::workstation | openssh | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::workstation | openssh-askpass | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::workstation | openssh-clients | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::workstation | openssh-debuginfo | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::workstation | openssh-keycat | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::workstation | openssh-ldap | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::workstation | openssh-server | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::workstation | openssh-server-sysvinit | 0 | 0:6.6.1p1-23.el7_2 |
| Red Hat:enterprise_linux:7::workstation | pam_ssh_agent_auth | 0 | 0:0.9.3-9.23.el7_2 |
| SUSE:Linux Enterprise Desktop 11 SP3 | openssh | 0 | 6.2p2-0.24.1 |
| SUSE:Linux Enterprise Desktop 11 SP3 | openssh-askpass-gnome | 0 | 6.2p2-0.24.3 |
| SUSE:Linux Enterprise Desktop 11 SP4 | openssh | 0 | 6.6p1-16.1 |
| SUSE:Linux Enterprise Desktop 11 SP4 | openssh-askpass-gnome | 0 | 6.6p1-16.4 |
| SUSE:Linux Enterprise Desktop 12 | openssh | 0 | 6.6p1-33.1 |
| SUSE:Linux Enterprise Desktop 12 | openssh-askpass-gnome | 0 | 6.6p1-33.1 |
| SUSE:Linux Enterprise Desktop 12 SP1 | openssh | 0 | 6.6p1-33.1 |
| SUSE:Linux Enterprise Desktop 12 SP1 | openssh-askpass-gnome | 0 | 6.6p1-33.1 |
| SUSE:Linux Enterprise Server 11 SP3 | openssh | 0 | 6.2p2-0.24.1 |
| SUSE:Linux Enterprise Server 11 SP3 | openssh-askpass-gnome | 0 | 6.2p2-0.24.3 |
| SUSE:Linux Enterprise Server 11 SP3-TERADATA | openssh | 0 | 6.2p2-0.24.1 |
| SUSE:Linux Enterprise Server 11 SP3-TERADATA | openssh-askpass-gnome | 0 | 6.2p2-0.24.3 |
| SUSE:Linux Enterprise Server 11 SP4 | openssh | 0 | 6.6p1-16.1 |
| SUSE:Linux Enterprise Server 11 SP4 | openssh-askpass-gnome | 0 | 6.6p1-16.4 |
| SUSE:Linux Enterprise Server 11-SECURITY | openssh-openssl1 | 0 | 6.6p1-10.1 |
| SUSE:Linux Enterprise Server 12 | openssh | 0 | 6.6p1-33.1 |
| SUSE:Linux Enterprise Server 12 | openssh-askpass-gnome | 0 | 6.6p1-33.1 |
| SUSE:Linux Enterprise Server 12 SP1 | openssh | 0 | 6.6p1-33.1 |
| SUSE:Linux Enterprise Server 12 SP1 | openssh-askpass-gnome | 0 | 6.6p1-33.1 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP3 | openssh | 0 | 6.2p2-0.24.1 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP3 | openssh-askpass-gnome | 0 | 6.2p2-0.24.3 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | openssh | 0 | 6.6p1-16.1 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | openssh-askpass-gnome | 0 | 6.6p1-16.4 |
| SUSE:Linux Enterprise Server for SAP Applications 12 | openssh | 0 | 6.6p1-33.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 | openssh-askpass-gnome | 0 | 6.6p1-33.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | openssh | 0 | 6.6p1-33.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | openssh-askpass-gnome | 0 | 6.6p1-33.1 |
| Ubuntu:14.04:LTS | openssh | 0 | 1:6.6p1-2ubuntu2.4 |
| openSUSE:Tumbleweed | openssh | 0 | 7.2p2-3.1 |
Related vulnerabilities
- CVE-2023-51385 In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host… Also affects openssh
- CVE-2021-41617 sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are… Also affects openssh
- CVE-2016-10708 sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL… Also affects openssh
- CVE-2016-1908 The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11… Also affects openssh
- CVE-2016-6210 sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing… Also affects openssh
- CVE-2016-10009 Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4… Also affects openssh
- CVE-2016-8858 The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote… Also affects openssh
- CVE-2016-6515 The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit… Also affects openssh