CVE-2016-1908
published 2017-04-11CVE-2016-1908: The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control…
PriorityP262critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
13.74%
96.1th percentile
The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.
Affected
32 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | openssh | < openssh 1:7.2p1-1 (bookworm) | openssh 1:7.2p1-1 (bookworm) |
| openbsd | openssh | < 7.2 | 7.2 |
| openbsd | openssh | >= 0 < 1:7.2p1-1 | 1:7.2p1-1 |
| openbsd | openssh | >= 0 < 1:7.2p1-1 | 1:7.2p1-1 |
| openbsd | openssh | >= 0 < 1:7.2p1-1 | 1:7.2p1-1 |
| openbsd | openssh | >= 0 < 1:7.2p1-1 | 1:7.2p1-1 |
| openbsd | openssh | >= 0 < 1:6.6p1-2ubuntu2.7 | 1:6.6p1-2ubuntu2.7 |
| oracle | linux | — | — |
| oracle | linux | — | — |
| paloalto | pan-os | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect SSH connections using untrusted X11 forwarding ('ssh -X') that may silently fall back to trusted X11 forwarding ('ssh -Y') behavior — monitor for X11 forwarding sessions where the SECURITY extension is absent on the local X server ↗
- →Flag systems where the X server lacks the SECURITY extension AND has 'xhost +si:localuser:<user>' enabled — both conditions together enable exploitation of this fallback on RHEL 7 and current Fedora ↗
- →Identify vulnerable OpenSSH client versions prior to 7.2; patch to 7.2p1-1 or later resolves the issue ↗
- ·Exploitation requires the local X server to lack the SECURITY extension (not compiled in by default for X.org since 2007) AND to have non-MIT-cookie authentication methods enabled (e.g. localuser auth); systems with the SECURITY extension present (e.g. RHEL 6 after RHSA-2013:1620) are not vulnerable to the fallback ↗
- ·PAN-OS applied code changes in response to CVE-2016-1908 but confirmed PAN-OS itself is not impacted by this issue ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
OpenBSD OpenSSH 7.1 X11 Forwarding 7pk security (FEDORA-2016-4509765b4b / Nessus ID 89528)
vuldb·2026-05-30·CVSS 9.8
CVE-2016-1908 [CRITICAL] OpenBSD OpenSSH 7.1 X11 Forwarding 7pk security (FEDORA-2016-4509765b4b / Nessus ID 89528)
A vulnerability, which was classified as critical, has been found in OpenBSD OpenSSH 7.1. This vulnerability affects unknown code of the component X11 Forwarding. Performing a manipulation results in 7pk security features.
This vulnerability is known as CVE-2016-1908. Remote exploitation of the attack is possible. No exploit is available.
It is advisable to upgrade the affected component.
GHSA
GHSA-mgwc-m57j-46w8: The client in OpenSSH before 7
ghsa_unreviewed·2022-05-14
CVE-2016-1908 [CRITICAL] CWE-287 GHSA-mgwc-m57j-46w8: The client in OpenSSH before 7
The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.
OSV
CVE-2016-1908: The client in OpenSSH before 7
osv·2017-04-11·CVSS 9.8
CVE-2016-1908 [CRITICAL] CVE-2016-1908: The client in OpenSSH before 7
The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.
OSV
openssh vulnerabilities
osv·2016-05-09·CVSS 7.8
CVE-2015-8325 [HIGH] openssh vulnerabilities
openssh vulnerabilities
Shayan Sadigh discovered that OpenSSH incorrectly handled environment files
when the UseLogin feature is enabled. A local attacker could use this issue
to gain privileges. (CVE-2015-8325)
Ben Hawkes discovered that OpenSSH incorrectly handled certain network
traffic. A remote attacker could possibly use this issue to cause OpenSSH
to crash, resulting in a denial of service. This issue only applied to
Ubuntu 15.10. (CVE-2016-1907)
Thomas Hoger discovered that OpenSSH incorrectly handled untrusted X11
forwarding when the SECURITY extension is disabled. A connection configured
as being untrusted could get switched to trusted in certain scenarios,
contrary to expectations. (CVE-2016-1908)
It was discovered that OpenSSH incorrectly handled certain X11 forwarding
data
CISA ICS
Siemens SCALANCE X-200RNA Switch Devices
cisa_ics·2022-12-19
Siemens SCALANCE X-200RNA Switch Devices
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SCALANCE X-200RNA Switch Devices
Last RevisedDecember 19, 2022
Alert CodeICSA-22-349-21
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity/public exploits are available
- Vendor: Siemens
- Equipment: SCALANCE X-200RNA switch devices before V3.2.7
- Vulnerabilities: Observable Timing Discrepancy; Race Condition; Improper Restriction of Operations within the Bounds of a Memory Buffer; Improper Input Validation; NULL Pointer Dereference; Use After Free; Cryptographic Issues; Comparison of Incompatible Types; Resource Management
Palo Alto
PAN-SA-2020-0004 Informational: Third-party or open source vulnerabilities that do not affect PAN-OS
vendor_paloalto·2020-05-13·CVSS 7.5
CVE-2014-1692 [HIGH] PAN-SA-2020-0004 Informational: Third-party or open source vulnerabilities that do not affect PAN-OS
PAN-SA-2020-0004 Informational: Third-party or open source vulnerabilities that do not affect PAN-OS
Palo Alto Networks Product Security Assurance team has evaluated and determined that these third-party or open source vulnerabilities do not have a security impact on PAN-OS, or the scenarios required for successful
CVEs: CVE-2014-1692, CVE-2014-2532, CVE-2014-2653, CVE-2015-5352, CVE-2015-8325, CVE-2016-10009, CVE-2016-10010, CVE-2016-10708, CVE-2016-1908, CVE-2016-3115, CVE-2016-6515, CVE-2018-15473, CVE-2018-15919
Affected products: PAN-OS
Palo Alto
PAN-SA-2020-0005 PAN-OS: OpenSSH software upgraded to resolve multiple vulnerabilities
vendor_paloalto·2020-05-13·CVSS 7.8
CVE-2016-10012 [HIGH] CWE-119 PAN-SA-2020-0005 PAN-OS: OpenSSH software upgraded to resolve multiple vulnerabilities
PAN-SA-2020-0005 PAN-OS: OpenSSH software upgraded to resolve multiple vulnerabilities
OpenSSH software included with PAN-OS has been upgraded to resolve security vulnerability CVE-2016-10012. Additionally, code changes have been made to the server component of the OpenSSH software included in PAN-OS in response to CVE-2015-8325 and CVE-2016-1908 though PAN-OS is not impacted by these issues. This issues affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.1; All versions of PAN-OS 8.0. CVE CVSS Summary CVE-2016-10012 7.8 ( CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H ) The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enf
Ubuntu
OpenSSH vulnerabilities
vendor_ubuntu·2016-05-09·CVSS 7.8
CVE-2015-8325 [HIGH] OpenSSH vulnerabilities
Title: OpenSSH vulnerabilities
Summary: Several security issues were fixed in OpenSSH.
Shayan Sadigh discovered that OpenSSH incorrectly handled environment files
when the UseLogin feature is enabled. A local attacker could use this issue
to gain privileges. (CVE-2015-8325)
Ben Hawkes discovered that OpenSSH incorrectly handled certain network
traffic. A remote attacker could possibly use this issue to cause OpenSSH
to crash, resulting in a denial of service. This issue only applied to
Ubuntu 15.10. (CVE-2016-1907)
Thomas Hoger discovered that OpenSSH incorrectly handled untrusted X11
forwarding when the SECURITY extension is disabled. A connection configured
as being untrusted could get switched to trusted in certain scenarios,
contrary to expectations. (CVE-2016-1908)
It was discove
Red Hat
openssh: possible fallback from untrusted to trusted X11 forwarding
vendor_redhat·2016-01-14·CVSS 9.8
CVE-2016-1908 [CRITICAL] CWE-284 openssh: possible fallback from untrusted to trusted X11 forwarding
openssh: possible fallback from untrusted to trusted X11 forwarding
The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.
An access flaw was discovered in OpenSSH; the OpenSSH client did not correctly handle failures to generate authentication cookies for untrusted X11 forwarding. A malicious or compromised remote X application could possibly use this flaw to establish a trusted connection to the local X server, even if only untrusted X11 forwarding was request
Debian
CVE-2016-1908: openssh - The client in OpenSSH before 7.2 mishandles failed cookie generation for untrust...
vendor_debian·2016·CVSS 9.8
CVE-2016-1908 [CRITICAL] CVE-2016-1908: openssh - The client in OpenSSH before 7.2 mishandles failed cookie generation for untrust...
The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.
Scope: local
bookworm: resolved (fixed in 1:7.2p1-1)
bullseye: resolved (fixed in 1:7.2p1-1)
forky: resolved (fixed in 1:7.2p1-1)
sid: resolved (fixed in 1:7.2p1-1)
trixie: resolved (fixed in 1:7.2p1-1)
No detection rules found.
No public exploits indexed.
http://openwall.com/lists/oss-security/2016/01/15/13http://rhn.redhat.com/errata/RHSA-2016-0465.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0741.htmlhttp://www.openssh.com/txt/release-7.2http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttp://www.securityfocus.com/bid/84427http://www.securitytracker.com/id/1034705https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416chttps://bugzilla.redhat.com/show_bug.cgi?id=1298741https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfhttps://lists.debian.org/debian-lts-announce/2018/09/msg00010.htmlhttps://security.gentoo.org/glsa/201612-18http://openwall.com/lists/oss-security/2016/01/15/13http://rhn.redhat.com/errata/RHSA-2016-0465.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0741.htmlhttp://www.openssh.com/txt/release-7.2http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttp://www.securityfocus.com/bid/84427http://www.securitytracker.com/id/1034705https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416chttps://bugzilla.redhat.com/show_bug.cgi?id=1298741https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfhttps://lists.debian.org/debian-lts-announce/2018/09/msg00010.htmlhttps://security.gentoo.org/glsa/201612-18
2017-04-11
Published