OpenSSH: Multiple vulnerabilities

Background OpenSSH is a complete SSH protocol implementation that includes SFTP client and server support. Description Qualys have reported two issues in the “roaming” code included in the OpenSSH client, which provides undocumented, experimental support for resuming SSH connections. An OpenSSH...

MGASA-2016-0022 Updated openssh packages fix security vulnerabilities

An information leak flaw was found in the way the OpenSSH client roaming feature was implemented. A malicious server could potentially use this flaw to leak portions of memory possibly including private SSH keys of a successfully authenticated OpenSSH client CVE-2016-0777. A buffer overflow flaw...

Updated openssh packages fix security vulnerabilities

An information leak flaw was found in the way the OpenSSH client roaming feature was implemented. A malicious server could potentially use this flaw to leak portions of memory possibly including private SSH keys of a successfully authenticated OpenSSH client CVE-2016-0777. A buffer overflow flaw...

Mike Mimoso and Chris Brook Discuss the OpenSSH Patch, the Silverlight Zero Day, and More

Mike Mimoso and Chris Brook discuss the week in news, including a critical flaw patched by OpenSSH, the curious tale behind a Silverlight zero day, and how to turn a hacked webcam into a backdoor. Download: newswrap01-08-16.mp3 Music by Chris Gonsalves...

[slackware-security] openssh

New openssh packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/openssh-7.1p2-i486-1slack14.1.txz: Upgraded. This update fixes an information leak and a buffer overflow. I...

Security update for openssh (critical)

This update for openssh fixes the following issues: - CVE-2016-0777: A malicious or compromised server could cause the OpenSSH client to expose part or all of the client's private key through the roaming feature bsc961642 - CVE-2016-0778: A malicious or compromised server could could trigger a...

Security update for openssh (critical)

This update for openssh fixes the following issues: - CVE-2016-0777: A malicious or compromised server could cause the OpenSSH client to expose part or all of the client's private key through the roaming feature bsc961642 - CVE-2016-0778: A malicious or compromised server could could trigger a...

CentOS Update for openssh CESA-2016:0043 centos7

Check the version of openssh SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882368";...

Scientific Linux Security Update : openssh on SL7.x x86_64 (20160114)

An information leak flaw was found in the way the OpenSSH client roaming feature was implemented. A malicious server could potentially use this flaw to leak portions of memory possibly including private SSH keys of a successfully authenticated OpenSSH client. CVE-2016-0777 A buffer overflow flaw...

Oracle Linux 7 : openssh (ELSA-2016-0043)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0043 advisory. 6.6.1p1-23 + 0.9.3-9 - Disable undocumented feauture Roaming for good 1298218 - prevents CVE-2016-0777 and CVE-2016-0778 Tenable has extracted the...

OpenSSH client Information Leak & Buffer Overflow

Since version 5.4 released on March 8, 2010, the OpenSSH client supports an undocumented feature called roaming: if the connection to an SSH server breaks unexpectedly, and if the server supports roaming as well, the client is able to reconnect to the server and resume the suspended SSH session...

Ubuntu 14.04 LTS : OpenSSH vulnerabilities (USN-2869-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2869-1 advisory. It was discovered that the OpenSSH client experimental support for resuming connections contained multiple security issues. A malicious server could use...

Debian DSA-3446-1 : openssh - security update

The Qualys Security team discovered two vulnerabilities in the roaming code of the OpenSSH client an implementation of the SSH protocol suite. SSH roaming enables a client, in case an SSH connection breaks unexpectedly, to resume it at a later time, provided the server also supports it. The OpenS...

SUSE: Security Advisory for openssh (SUSE-SU-2016:0118-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for openssh (openSUSE-SU-2016:0127-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD : openssh -- information disclosure (dfe0cdc1-baf2-11e5-863a-b499baebfeaf)

OpenSSH reports : OpenSSH clients between versions 5.4 and 7.1 are vulnerable to information disclosure that may allow a malicious server to retrieve information including under some circumstances, user's private keys. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

OpenSSH < 7.1p2 Multiple Vulnerabilities

Binary data 9055.prm...

CVE-2016-1908

The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues ...

Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : openssh (SSA:2016-014-01)

New openssh packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2016-014-01. The text...

Oracle: Security Advisory (ELSA-2016-0043)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...