USN-2966-1 OpenSSH vulnerabilities

Low

Vendor

Canonical Ubuntu, openssh

Versions Affected

• Canonical Ubuntu 14.04 LTS

Description

Shayan Sadigh discovered that OpenSSH incorrectly handled environment files when the UseLogin feature is enabled. A local attacker could use this issue to gain privileges. (CVE-2015-8325)

Ben Hawkes discovered that OpenSSH incorrectly handled certain network traffic. A remote attacker could possibly use this issue to cause OpenSSH to crash, resulting in a denial of service. This issue only applied to Ubuntu 15.10. (CVE-2016-1907)

Thomas Hoger discovered that OpenSSH incorrectly handled untrusted X11 forwarding when the SECURITY extension is disabled. A connection configured as being untrusted could get switched to trusted in certain scenarios, contrary to expectations. (CVE-2016-1908)

It was discovered that OpenSSH incorrectly handled certain X11 forwarding data. A remote authenticated attacker could possibly use this issue to bypass certain intended command restrictions. (CVE-2016-3115)

Affected Products and Versions

_Severity is low unless otherwise noted.
_

• All versions of Cloud Foundry cflinuxfs2 prior to v.1.56.0
• Cloud Foundry BOSH stemcells 3146.x versions prior to 3146.12 AND other versions prior to 3232.4 are vulnerable

Mitigation

Users of affected versions should apply the following mitigation:

• The Cloud Foundry project recommends that Cloud Foundry deployments run with cflinuxfs2 v.1.56.0 or later versions
• The Cloud Foundry project recommends that Cloud Foundry upgrade BOSH stemcell 3146.x versions to 3146.12 OR other versions to 3232.4

Credit

Ben Hawkes, Thomas Hoger, Shayan Sadigh

References

• <http://www.ubuntu.com/usn/usn-2966-1/&gt;
• <http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8325.html&gt;
• <http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1907.html&gt;
• <http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1908.html&gt;
• <http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-3115.html&gt;