Information Exposure Affecting openssh package, versions <1:6.7p1-5+deb8u1
Snyk CVSS
Attack Complexity
Low
Confidentiality
High
Threat Intelligence
EPSS
0.24% (62nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN8-OPENSSH-368752
- published 14 Jan 2016
- disclosed 14 Jan 2016
Introduced: 14 Jan 2016
CVE-2016-0777 Open this link in a new tabHow to fix?
Upgrade Debian:8
openssh
to version 1:6.7p1-5+deb8u1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream openssh
package and not the openssh
package as distributed by Debian
.
See How to fix?
for Debian:8
relevant fixed versions and status.
The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key.
References
- https://security-tracker.debian.org/tracker/CVE-2016-0777
- https://support.apple.com/HT206167
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html
- http://www.securityfocus.com/archive/1/537295/100/0/threaded
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734
- https://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/
- https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/
- https://bto.bluecoat.com/security-advisory/sa109
- http://www.openssh.com/txt/release-7.1p2
- http://www.debian.org/security/2016/dsa-3446
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176516.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175592.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175676.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176349.html
- https://security.FreeBSD.org/advisories/FreeBSD-SA-16:07.openssh.asc
- https://security.gentoo.org/glsa/201601-01
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- http://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-Overflow-Leak.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00007.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00013.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00014.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.openwall.com/lists/oss-security/2016/01/14/7
- http://seclists.org/fulldisclosure/2016/Jan/44
- http://www.securityfocus.com/bid/80695
- http://www.securitytracker.com/id/1034671
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-0777
- http://www.ubuntu.com/usn/USN-2869-1
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf