OpenSSH Client contains a client information leak vulnerability and buffer overflow

Overview

OpenSSH client code versions 5.4 through 7.1p1 contains a client information leak vulnerability that could allow an OpenSSH client to leak information not limited to but including private keys, as well as a buffer overflow in certain non-default configurations.

Description

CWE-200**: Information Exposure -**CVE-2016-0777

According to the OpenSSH release notes for version 7.1p2 :

The OpenSSH client code between 5.4 and 7.1 contains experimental support for resuming SSH-connections (roaming).

_ The matching server code has never been shipped, but the client code was enabled by default and could be tricked by a malicious server into leaking client memory to the server, including private client user keys._

_ The authentication of the server host key prevents exploitation by a man-in-the-middle, so this information leak is restricted to connections to malicious or compromised servers._

CWE-122**: Heap-based Buffer Overflow -**CVE-2016-0778

According to Qualys, the API functions packet_write_wait() and ssh_packet_write_wait() may overflow in some scenarios after a successful reconnection.

Qualys also notes that:

The buffer overflow, on the other hand, is present in the default configuration of the OpenSSH client but its exploitation requires two non-default options: a ProxyCommand, and either ForwardAgent (-A) or ForwardX11 (-X). This buffer overflow is therefore unlikely to have any real-world impact, but provides a particularly interesting case study.
For more information, please see Qualys’s advisory. The CVSS score below is based on CVE-2016-0777.

Impact

A user that authenticates to a malicious or compromised server may reveal private data, including the user’s private SSH key, or cause a buffer overflow that may lead to remote code execution in certain non-default configurations.

---

Solution

Apply an update

OpenSSH 7.1p2 has released to address these issues. Affected users are recommended to update as soon as possible.

If update is currently not an option, you may consider the following workaround:

---

Disable the ‘UseRoaming’ Feature

The vulnerable code in the client can be completely disabled by adding ‘UseRoaming no’ to the global ssh_config(5) file, or to user configuration in ~/.ssh/config, or by passing -oUseRoaming=no on the command line.

---

Vendor Information

456088

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Debian GNU/Linux Affected

Notified: January 14, 2016 Updated: January 14, 2016

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <https://security-tracker.debian.org/tracker/CVE-2016-0777&gt;
• <https://security-tracker.debian.org/tracker/CVE-2016-0778&gt;

Hardened BSD __ Affected

Notified: January 14, 2016 Updated: January 14, 2016

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

`"We released new versions with the workaround:

<https://github.com/HardenedBSD/hardenedBSD-stable/commit/831e4682e627882dec74300&gt;
52af7b74541aa79dc
<https://github.com/HardenedBSD/hardenedBSD/commit/efa4e9c808a18c3f6c291981d1a463&gt;
b10ba8c514

Fixed in these version:
<https://github.com/HardenedBSD/hardenedBSD-stable/releases/tag/HardenedBSD-10-ST&gt;
ABLE-v39.1
<https://github.com/HardenedBSD/hardenedBSD-stable/releases/tag/HardenedBSD-11-CU&gt;
RRENT-v39.2"`

OpenBSD __ Affected

Notified: January 14, 2016 Updated: January 15, 2016

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

OpenBSD has patches available:

Vendor References

• <http://ftp.openbsd.org/pub/OpenBSD/patches/5.8/common/010_ssh.patch.sig&gt;
• <http://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/022_ssh.patch.sig&gt;

OpenSSH Affected

Updated: January 14, 2016

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <http://www.openssh.com/txt/release-7.1p2&gt;

Ubuntu __ Affected

Notified: January 14, 2016 Updated: January 14, 2016

Statement Date: January 14, 2016

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Updates are now available for supported releases.

Vendor References

• <https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/OpenSSHClientRoaming&gt;
• <http://www.ubuntu.com/usn/usn-2869-1/&gt;

Openwall GNU/*/Linux __ Not Affected

Notified: January 14, 2016 Updated: January 20, 2016

Statement Date: January 19, 2016

Status

Not Affected

Vendor Statement

“Openwall GNU/*/Linux is not affected. We’re using a fork of an older version of OpenSSH, from prior to the introduction of the roaming feature.”

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

ACCESS Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

AT&T Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Alcatel-Lucent Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Apple Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Arch Linux Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Arista Networks, Inc. Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Aruba Networks Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Avaya, Inc. Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Barracuda Networks Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Belkin, Inc. Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Blue Coat Systems Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Brocade Communication Systems Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

CA Technologies Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

CentOS Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Check Point Software Technologies Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Cisco Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

CoreOS Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

D-Link Systems, Inc. Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

DesktopBSD Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

DragonFly BSD Project Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

EMC Corporation Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Enterasys Networks Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Ericsson Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

European Registry for Internet Domains Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Extreme Networks Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

F5 Networks, Inc. Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Fedora Project Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Force10 Networks Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Fortinet, Inc. Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Foundry Brocade Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

FreeBSD Project Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

GNU adns Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

GNU glibc Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Gentoo Linux Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Google Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Hewlett Packard Enterprise Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Hitachi Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Huawei Technologies Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

IBM eServer Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Infoblox Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Intel Corporation Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Internet Systems Consortium Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Internet Systems Consortium - DHCP Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

JH Software Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Juniper Networks Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

McAfee Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Microsoft Corporation Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

NEC Corporation Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

NLnet Labs Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

NetBSD Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Nokia Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Nominum Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

OmniTI Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

OpenDNS Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Oracle Corporation Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

PC-BSD Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Peplink Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

PowerDNS Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Q1 Labs Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

QNX Software Systems Inc. Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Red Hat, Inc. Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

SUSE Linux Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

SafeNet Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Secure64 Software Corporation Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Slackware Linux Inc. Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

SmoothWall Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Snort Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Sony Corporation Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Sourcefire Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Symantec Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

TippingPoint Technologies Inc. Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Turbolinux Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Unisys Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

VMware Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Wind River Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

ZyXEL Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

dnsmasq Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

gdnsd Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

m0n0wall Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

openSUSE project Unknown

Notified: January 14, 2016 Updated: January 14, 2016

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

View all 86 vendors __View less vendors __

CVSS Metrics

Group	Score	Vector
Base	4.3	AV:N/AC:M/Au:N/C:P/I:N/A:N
Temporal	3.6	E:F/RL:OF/RC:C
Environmental	2.7	CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

• <http://www.openssh.com/txt/release-7.1p2&gt;
• <https://www.qualys.com/2016/01/14/cve-2016-0777-cve-2016-0778/openssh-cve-2016-0777-cve-2016-0778.txt&gt;
• http://undeadly.org/cgi?action=article&sid=20160114142733
• <https://github.com/openssh/openssh-portable/blob/8408218c1ca88cb17d15278174a24a94a6f65fe1/roaming_client.c#L70&gt;
• <https://vulners.com/cve/CVE-2016-0777&gt;
• <https://isc.sans.edu/forums/diary/OpenSSH+71p2+released+with+security+fix+for+CVE20160777/20613/&gt;
• <https://access.redhat.com/articles/2123781&gt;

Acknowledgements

This issue was previously coordinated and publicly disclosed by the Qualys Security Advisory Team.

This document was written by Brian Gardiner and Garret Wassermann.

Other Information

CVE IDs:	CVE-2016-0777, CVE-2016-0778
Date Public:	2016-01-14 Date First Published: