1. CVE-Search
  2. CVE-2016-3115
ID CVE-2016-3115
Summary Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions. <a href="https://cwe.mitre.org/data/definitions/93.html">CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')</a>
References
Vulnerable Configurations
  • cpe:2.3:a:openbsd:openssh:1.2.2:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:1.2.2:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:1.2.3:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:1.2.3:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:2.1.0:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:2.1.0:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:2.1.1:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:2.1.1:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:2.2.0:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:2.2.0:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:2.3.0:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:2.3.0:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:2.5.1:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:2.5.1:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:2.9:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:2.9:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:2.9.9:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:2.9.9:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:3.0:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:3.0:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:3.0.1:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:3.0.1:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:3.0.2:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:3.0.2:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:3.1:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:3.1:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:3.2.2:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:3.2.2:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:3.2.3:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:3.2.3:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:3.3:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:3.3:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:3.4:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:3.4:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:3.5:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:3.5:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:3.6:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:3.6:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:3.6.1:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:3.6.1:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:3.7.1:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:3.7.1:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:3.8:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:3.8:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:3.8.1:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:3.8.1:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:3.9:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:3.9:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:4.0:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:4.0:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:4.1:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:4.1:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:4.2:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:4.2:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:4.3:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:4.3:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:4.4:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:4.4:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:4.5:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:4.5:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:4.6:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:4.6:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:4.7:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:4.7:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:4.8:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:4.8:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:4.9:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:4.9:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:5.0:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:5.0:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:5.1:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:5.1:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:5.2:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:5.2:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:5.3:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:5.3:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:5.4:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:5.4:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:5.5:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:5.5:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:5.6:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:5.6:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:5.7:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:5.7:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:5.8:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:5.8:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:5.9:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:5.9:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:6.0:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:6.0:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:6.1:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:6.1:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:6.2:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:6.2:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:6.3:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:6.3:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:6.4:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:6.4:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:6.5:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:6.5:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:6.6:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:6.6:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:6.7:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:6.7:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:6.8:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:6.8:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:6.9:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:6.9:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:7.0:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:7.0:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:7.1:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:7.1:p1:*:*:*:*:*:*
  • cpe:2.3:a:openbsd:openssh:7.2:p1:*:*:*:*:*:*
    cpe:2.3:a:openbsd:openssh:7.2:p1:*:*:*:*:*:*
  • cpe:2.3:o:oracle:vm_server:3.2:*:*:*:*:*:*:*
    cpe:2.3:o:oracle:vm_server:3.2:*:*:*:*:*:*:*
CVSS
Base: 5.5 (as of 11-09-2018 - 10:29)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL NONE
cvss-vector via4 AV:N/AC:L/Au:S/C:P/I:P/A:N
redhat via4
advisories
  • bugzilla
    id 1316829
    title CVE-2016-3115 openssh: missing sanitisation of input for X11 forwarding
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 7 is installed
        oval oval:com.redhat.rhba:tst:20150364027
      • OR
        • AND
          • comment openssh is earlier than 0:6.6.1p1-25.el7_2
            oval oval:com.redhat.rhsa:tst:20160465001
          • comment openssh is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20120884002
        • AND
          • comment openssh-askpass is earlier than 0:6.6.1p1-25.el7_2
            oval oval:com.redhat.rhsa:tst:20160465003
          • comment openssh-askpass is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20120884004
        • AND
          • comment openssh-clients is earlier than 0:6.6.1p1-25.el7_2
            oval oval:com.redhat.rhsa:tst:20160465005
          • comment openssh-clients is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20120884006
        • AND
          • comment openssh-keycat is earlier than 0:6.6.1p1-25.el7_2
            oval oval:com.redhat.rhsa:tst:20160465007
          • comment openssh-keycat is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20150425008
        • AND
          • comment openssh-ldap is earlier than 0:6.6.1p1-25.el7_2
            oval oval:com.redhat.rhsa:tst:20160465009
          • comment openssh-ldap is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20120884008
        • AND
          • comment openssh-server is earlier than 0:6.6.1p1-25.el7_2
            oval oval:com.redhat.rhsa:tst:20160465011
          • comment openssh-server is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20120884010
        • AND
          • comment openssh-server-sysvinit is earlier than 0:6.6.1p1-25.el7_2
            oval oval:com.redhat.rhsa:tst:20160465013
          • comment openssh-server-sysvinit is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20150425014
        • AND
          • comment pam_ssh_agent_auth is earlier than 0:0.9.3-9.25.el7_2
            oval oval:com.redhat.rhsa:tst:20160465015
          • comment pam_ssh_agent_auth is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20120884012
    rhsa
    id RHSA-2016:0465
    released 2016-03-21
    severity Moderate
    title RHSA-2016:0465: openssh security update (Moderate)
  • bugzilla
    id 1316829
    title CVE-2016-3115 openssh: missing sanitisation of input for X11 forwarding
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 6 is installed
        oval oval:com.redhat.rhba:tst:20111656003
      • OR
        • AND
          • comment openssh is earlier than 0:5.3p1-114.el6_7
            oval oval:com.redhat.rhsa:tst:20160466001
          • comment openssh is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20120884002
        • AND
          • comment openssh-askpass is earlier than 0:5.3p1-114.el6_7
            oval oval:com.redhat.rhsa:tst:20160466003
          • comment openssh-askpass is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20120884004
        • AND
          • comment openssh-clients is earlier than 0:5.3p1-114.el6_7
            oval oval:com.redhat.rhsa:tst:20160466005
          • comment openssh-clients is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20120884006
        • AND
          • comment openssh-ldap is earlier than 0:5.3p1-114.el6_7
            oval oval:com.redhat.rhsa:tst:20160466007
          • comment openssh-ldap is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20120884008
        • AND
          • comment openssh-server is earlier than 0:5.3p1-114.el6_7
            oval oval:com.redhat.rhsa:tst:20160466009
          • comment openssh-server is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20120884010
        • AND
          • comment pam_ssh_agent_auth is earlier than 0:0.9.3-114.el6_7
            oval oval:com.redhat.rhsa:tst:20160466011
          • comment pam_ssh_agent_auth is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20120884012
    rhsa
    id RHSA-2016:0466
    released 2016-03-21
    severity Moderate
    title RHSA-2016:0466: openssh security update (Moderate)
rpms
  • openssh-0:6.6.1p1-25.el7_2
  • openssh-askpass-0:6.6.1p1-25.el7_2
  • openssh-clients-0:6.6.1p1-25.el7_2
  • openssh-debuginfo-0:6.6.1p1-25.el7_2
  • openssh-keycat-0:6.6.1p1-25.el7_2
  • openssh-ldap-0:6.6.1p1-25.el7_2
  • openssh-server-0:6.6.1p1-25.el7_2
  • openssh-server-sysvinit-0:6.6.1p1-25.el7_2
  • pam_ssh_agent_auth-0:0.9.3-9.25.el7_2
  • openssh-0:5.3p1-114.el6_7
  • openssh-askpass-0:5.3p1-114.el6_7
  • openssh-clients-0:5.3p1-114.el6_7
  • openssh-debuginfo-0:5.3p1-114.el6_7
  • openssh-ldap-0:5.3p1-114.el6_7
  • openssh-server-0:5.3p1-114.el6_7
  • pam_ssh_agent_auth-0:0.9.3-114.el6_7
refmap via4
bid 84314
confirm
exploit-db 39569
fedora
  • FEDORA-2016-08e5803496
  • FEDORA-2016-0bcab055a7
  • FEDORA-2016-188267b485
  • FEDORA-2016-bb59db3c86
  • FEDORA-2016-d339d610c1
  • FEDORA-2016-fc1cc33e05
freebsd FreeBSD-SA-16:14
fulldisc
  • 20160314 CVE-2016-3115 - OpenSSH <=7.2p1 xauth injection
  • 20160314 CVE-2016-3116 - Dropbear SSH xauth injection
gentoo GLSA-201612-18
misc
mlist [debian-lts-announce] 20180910 [SECURITY] [DLA 1500-1] openssh security update
sectrack 1035249
Last major update 11-09-2018 - 10:29
Published 22-03-2016 - 10:59
Last modified 11-09-2018 - 10:29
Back to Top