CVE-2016-3115

Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.

Missing sanitisation of untrusted input allows an authenticated user who is able to request X11 forwarding to inject commands to xauth(1) (CVE-2016-3115).

This update for OpenSSH fixes three security issues.

These security issues were fixed:

• CVE-2016-3115: Sanitise input for xauth(1) (bsc#970632)
• CVE-2016-1908: Prevent X11 SECURITY circumvention when forwarding X11 connections (bsc#962313)
• CVE-2015-8325: Ignore PAM environment when using login (bsc#975865)

These non-security issues were fixed:

• Fix help output of sftp (bsc#945493)
• Restarting openssh with openssh-fips installed was not working correctly (bsc#945484)
• Fix crashes when /proc is not available in the chroot (bsc#947458)
• Correctly parse GSSAPI KEX algorithms (bsc#961368)
• More verbose FIPS mode/CC related documentation in README.FIPS (bsc#965576, bsc#960414)
• Fix PRNG re-seeding (bsc#960414, bsc#729190)
• Disable DH parameters under 2048 bits by default and allow lowering the limit back to the RFC 4419 specified minimum through an option (bsc#932483, bsc#948902)

openssh was updated to fix three security issues.

These security issues were fixed:

• CVE-2016-3115: Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH allowed remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions (bsc#970632).
• CVE-2016-1908: Possible fallback from untrusted to trusted X11 forwarding (bsc#962313).
• CVE-2015-8325: Ignore PAM environment vars when UseLogin=yes (bsc#975865).

These non-security issues were fixed:

• Correctly parse GSSAPI KEX algorithms (bsc#961368)
• More verbose FIPS mode/CC related documentation in README.FIPS (bsc#965576, bsc#960414)
• Fix PRNG re-seeding (bsc#960414, bsc#729190)
• Disable DH parameters under 2048 bits by default and allow lowering the limit back to the RFC 4419 specified minimum through an option (bsc#932483, bsc#948902)
• Allow empty Match blocks (bsc#961494)

This update for OpenSSH fixes the following issues:

• Prevent user enumeration through the timing of password processing. (bsc#989363, CVE-2016-6210)
• Allow lowering the DH groups parameter limit in server as well as when GSSAPI key exchange is used. (bsc#948902)
• Sanitize input for xauth(1). (bsc#970632, CVE-2016-3115)
• Prevent X11 SECURITY circumvention when forwarding X11 connections. (bsc#962313, CVE-2016-1908)
• Disable DH parameters under 2048 bits by default and allow lowering the limit back to the RFC 4419 specified minimum through an option. (bsc#932483, bsc#948902)
• Ignore PAM environment when using login. (bsc#975865, CVE-2015-8325)
• Limit the accepted password length (prevents a possible denial of service). (bsc#992533, CVE-2016-6515)
• Relax version requires for the openssh-askpass sub-package. (bsc#962794)
• Avoid complaining about unset DISPLAY variable. (bsc#981654)
• Initialize message id to prevent connection breakups in some cases. (bsc#959096)

This update for openssh-openssl1 fixes the following issues:

Security issues fixed:

• CVE-2016-6210: Prevent user enumeration through the timing of password processing (bsc#989363)
• CVE-2016-6515: limit accepted password length (prevents possible DoS) (bsc#992533)
• CVE-2016-3115: Sanitise input for xauth(1) (bsc#970632)
• CVE-2016-1908: prevent X11 SECURITY circumvention when forwarding X11 connections (bsc#962313)
• CVE-2015-8325: ignore PAM environment when using login (bsc#975865)
• Disable DH parameters under 2048 bits by default and allow lowering the limit back to the RFC 4419 specified minimum through an option (bsc#932483, bsc#948902)
• Allow lowering the DH groups parameter limit in server as well as when GSSAPI key exchange is used (bsc#948902)

Bugs fixed:

• avoid complaining about unset DISPLAY variable (bsc#981654)
• Correctly parse GSSAPI KEX algorithms (bsc#961368)
• more verbose FIPS mode/CC related documentation in README.FIPS (bsc#965576, bsc#960414)
• fix PRNG re-seeding (bsc#960414, bsc#729190)
• Allow empty Match blocks (bsc#961494)

Shayan Sadigh discovered that OpenSSH incorrectly handled environment files when the UseLogin feature is enabled. A local attacker could use this issue to gain privileges. (CVE-2015-8325)

Ben Hawkes discovered that OpenSSH incorrectly handled certain network traffic. A remote attacker could possibly use this issue to cause OpenSSH to crash, resulting in a denial of service. This issue only applied to Ubuntu 15.10. (CVE-2016-1907)

Thomas Hoger discovered that OpenSSH incorrectly handled untrusted X11 forwarding when the SECURITY extension is disabled. A connection configured as being untrusted could get switched to trusted in certain scenarios, contrary to expectations. (CVE-2016-1908)

It was discovered that OpenSSH incorrectly handled certain X11 forwarding data. A remote authenticated attacker could possibly use this issue to bypass certain intended command restrictions. (CVE-2016-3115)