2017-10-16 12:31:07 -04:00
{
2019-03-17 23:17:57 +00:00
"CVE_data_meta" : {
"ASSIGNER" : "cve@mitre.org" ,
"ID" : "CVE-2016-3115" ,
"STATE" : "PUBLIC"
} ,
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product" : {
"product_data" : [
{
"product_name" : "n/a" ,
"version" : {
"version_data" : [
{
"version_value" : "n/a"
}
]
}
}
]
} ,
"vendor_name" : "n/a"
}
2017-10-16 12:31:07 -04:00
]
2019-03-17 23:17:57 +00:00
}
} ,
"data_format" : "MITRE" ,
"data_type" : "CVE" ,
"data_version" : "4.0" ,
"description" : {
"description_data" : [
{
"lang" : "eng" ,
"value" : "Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions."
}
]
} ,
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng" ,
"value" : "n/a"
}
]
}
]
} ,
"references" : {
"reference_data" : [
{
"name" : "http://www.openssh.com/txt/x11fwd.adv" ,
"refsource" : "CONFIRM" ,
"url" : "http://www.openssh.com/txt/x11fwd.adv"
} ,
{
"name" : "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html" ,
"refsource" : "CONFIRM" ,
"url" : "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html"
} ,
{
"name" : "https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115" ,
"refsource" : "MISC" ,
"url" : "https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115"
} ,
{
"name" : "http://packetstormsecurity.com/files/136234/OpenSSH-7.2p1-xauth-Command-Injection-Bypass.html" ,
"refsource" : "MISC" ,
"url" : "http://packetstormsecurity.com/files/136234/OpenSSH-7.2p1-xauth-Command-Injection-Bypass.html"
} ,
{
"name" : "FreeBSD-SA-16:14" ,
"refsource" : "FREEBSD" ,
"url" : "https://www.freebsd.org/security/advisories/FreeBSD-SA-16:14.openssh.asc"
} ,
{
"name" : "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html" ,
"refsource" : "CONFIRM" ,
"url" : "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"
} ,
{
"name" : "39569" ,
"refsource" : "EXPLOIT-DB" ,
"url" : "https://www.exploit-db.com/exploits/39569/"
} ,
{
"name" : "RHSA-2016:0466" ,
"refsource" : "REDHAT" ,
"url" : "http://rhn.redhat.com/errata/RHSA-2016-0466.html"
} ,
{
"name" : "http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/session.c" ,
"refsource" : "CONFIRM" ,
"url" : "http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/session.c"
} ,
{
"name" : "1035249" ,
"refsource" : "SECTRACK" ,
"url" : "http://www.securitytracker.com/id/1035249"
} ,
{
"name" : "FEDORA-2016-fc1cc33e05" ,
"refsource" : "FEDORA" ,
"url" : "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183101.html"
} ,
{
"name" : "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html" ,
"refsource" : "CONFIRM" ,
"url" : "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
} ,
{
"name" : "http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/session.c.diff?r1=1.281&r2=1.282&f=h" ,
"refsource" : "CONFIRM" ,
"url" : "http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/session.c.diff?r1=1.281&r2=1.282&f=h"
} ,
{
"name" : "FEDORA-2016-d339d610c1" ,
"refsource" : "FEDORA" ,
"url" : "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180491.html"
} ,
{
"name" : "https://bto.bluecoat.com/security-advisory/sa121" ,
"refsource" : "CONFIRM" ,
"url" : "https://bto.bluecoat.com/security-advisory/sa121"
} ,
{
"name" : "GLSA-201612-18" ,
"refsource" : "GENTOO" ,
"url" : "https://security.gentoo.org/glsa/201612-18"
} ,
{
"name" : "84314" ,
"refsource" : "BID" ,
"url" : "http://www.securityfocus.com/bid/84314"
} ,
{
"name" : "FEDORA-2016-0bcab055a7" ,
"refsource" : "FEDORA" ,
"url" : "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179924.html"
} ,
{
"name" : "[debian-lts-announce] 20180910 [SECURITY] [DLA 1500-1] openssh security update" ,
"refsource" : "MLIST" ,
"url" : "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html"
} ,
{
"name" : "FEDORA-2016-08e5803496" ,
"refsource" : "FEDORA" ,
"url" : "http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184264.html"
} ,
{
"name" : "20160314 CVE-2016-3116 - Dropbear SSH xauth injection" ,
"refsource" : "FULLDISC" ,
"url" : "http://seclists.org/fulldisclosure/2016/Mar/47"
} ,
{
"name" : "RHSA-2016:0465" ,
"refsource" : "REDHAT" ,
"url" : "http://rhn.redhat.com/errata/RHSA-2016-0465.html"
} ,
{
"name" : "FEDORA-2016-188267b485" ,
"refsource" : "FEDORA" ,
"url" : "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183122.html"
} ,
{
"name" : "20160314 CVE-2016-3115 - OpenSSH <=7.2p1 xauth injection" ,
"refsource" : "FULLDISC" ,
"url" : "http://seclists.org/fulldisclosure/2016/Mar/46"
} ,
{
"name" : "FEDORA-2016-bb59db3c86" ,
"refsource" : "FEDORA" ,
"url" : "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178838.html"
}
]
}
}
