Vulnerability in OpenBSD OpenSSH
CVE-2016-3115
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.
Vulnerability class: CRLF Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.370 (98.5th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.370 · newest: 0.370 · change: 0.000
Affected products
- OpenBSD OpenSSH
- Oracle Vm Server — versions 3.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.openssh.com/txt/x11fwd.adv (Vendor Advisory)
- www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html (Vendor Advisory)
- github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115
- packetstormsecurity.com/files/136234/OpenSSH-7.2p1-xauth-Command-Injection-Bypa…
- www.freebsd.org/security/advisories/FreeBSD-SA-16:14.openssh.asc (vendor-advisory)
- www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- www.exploit-db.com/exploits/39569/ (exploit)
- rhn.redhat.com/errata/RHSA-2016-0466.html (vendor-advisory)
- cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/session.c
- www.securitytracker.com/id/1035249 (vdb-entry)
Frequently asked questions
- What is CVE-2016-3115?
- CVE-2016-3115 is a medium-severity vulnerability in OpenBSD OpenSSH, classified under CRLF Injection. CVSS score: 6.4/10. Published 2016-03-22.
- How severe is CVE-2016-3115?
- Medium severity. CVSS v3 base score is 6.4 out of 10.
- Is CVE-2016-3115 known to be exploited?
- 19 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.