Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-10009 — Untrusted Search Path in Openssh

CWE-426 — Untrusted Search PathCWE-428 — Unquoted Search Path or ElementCWE-94 — Code Injection16 documents13 sources
Severity
7.3HIGHNVD
EPSS
1.6%
top 18.40%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Openbsd OpensshPaloalto Pan-os
Timeline
PublishedJan 5
Latest updateJul 19

Description

Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LExploitability: 3.9 | Impact: 3.4

Affected Packages4 packages

▶Debianopenbsd/openssh< 1:7.4p1-1+3
▶Ubuntuopenbsd/openssh< 1:6.6p1-2ubuntu2.10+1
▶Palo Altopaloalto/pan-os

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-5rjr-wmvr-493x: Untrusted search path vulnerability in ssh-agent↗2022-05-14
▶
OSV
openssh vulnerabilities↗2018-01-22
▶
OSV
CVE-2016-10009: Untrusted search path vulnerability in ssh-agent↗2017-01-05
▶
CVEList
CVE-2016-10009: Untrusted search path vulnerability in ssh-agent↗2017-01-05
▶

💥Exploits & PoCs

1
Exploit-DB
OpenSSH < 7.4 - agent Protocol Arbitrary Library Loading↗2016-12-23
▶

📋Vendor Advisories

8
Red Hat
openssh: Remote code execution in ssh-agent PKCS#11 support↗2023-07-19
▶
Microsoft
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code↗2023-07-11
▶
Palo Alto
PAN-SA-2020-0004 Informational: Third-party or open source vulnerabilities that do not affect PAN-OS↗2020-05-13
▶
Ubuntu
OpenSSH vulnerabilities↗2018-01-22
▶
Apple
CVE-2016-10009: macOS Sierra 10.12.4, Security Update 2017-001 El Capitan, and Security Update 2017-001 Yosemite↗2017-03-27
▶

💬Community

2
Bugzilla
CVE-2016-10009 openssh: loading of untrusted PKCS#11 modules in ssh-agent↗2016-12-20
▶
Bugzilla
CVE-2016-10009 CVE-2016-10010 CVE-2016-10011 CVE-2016-10012 openssh: various flaws [fedora-all]↗2016-12-20
▶
CVE-2016-10009 — Untrusted Search Path in Openssh | cvebase