CVE-2016-10708

What it actually does

Remote unauthenticated attacker sends out-of-sequence NEWKEYS message during key exchange, triggering NULL pointer dereference in kex.c and packet.c that crashes the sshd daemon.

Why it matters to the business

Temporary loss of SSH-based remote management and file transfer capabilities on affected servers, leading to operational downtime until the daemon is restarted.

How an attack unfolds

An attacker initiates an SSH connection and deliberately transmits a NEWKEYS message before the expected key exchange sequence completes, causing the daemon to dereference a null pointer and terminate.

How to fix it

Upgrade openssh-portable to the version containing commit 4a354fc231174901f2629437c2a6e924a2dd6772 or later; restart sshd after the update.

How to confirm the fix worked

Verify the installed OpenSSH build contains commit 4a354fc231174901f2629437c2a6e924a2dd6772; attempt to reproduce the crash with a fuzzer such as Honggfuzz on a test instance to confirm the defect is absent.

Typical attack path

1. Open a TCP connection to the SSH port
2. Send an out-of-sequence NEWKEYS message during the handshake
3. Trigger NULL pointer dereference and observe daemon crash

How to detect it

Review sshd logs and system crash reports for entries referencing kex or packet handling failures around the time of unexpected daemon restarts.

What your security team should do

• Apply the fixed commit to all OpenSSH deployments immediately
• Restart sshd services after patching
• Monitor sshd process uptime and system logs for unexpected restarts