CVE-2016-0778

Vulnerability Description

The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings.

CVSS Score

Affected Products

Related Weaknesses (CWE)

References

• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734Third Party Advisory
• http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.htmlMailing ListRelease NotesThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176516.hMailing ListThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176349.htMailing ListThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00006.htmlMailing ListThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00007.htmlMailing ListThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00008.htmlMailing ListThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00009.htmlMailing ListThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00013.htmlMailing ListThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00014.htmlMailing ListThird Party Advisory
• http://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-OveThird Party AdvisoryVDB Entry
• http://seclists.org/fulldisclosure/2016/Jan/44Mailing ListThird Party Advisory
• http://www.debian.org/security/2016/dsa-3446Third Party Advisory
• http://www.openssh.com/txt/release-7.1p2PatchRelease NotesVendor Advisory
• http://www.openwall.com/lists/oss-security/2016/01/14/7ExploitMailing ListTechnical Description