CVE-2016-1908

The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.

This update for OpenSSH fixes three security issues.

These security issues were fixed:

• CVE-2016-3115: Sanitise input for xauth(1) (bsc#970632)
• CVE-2016-1908: Prevent X11 SECURITY circumvention when forwarding X11 connections (bsc#962313)
• CVE-2015-8325: Ignore PAM environment when using login (bsc#975865)

These non-security issues were fixed:

• Fix help output of sftp (bsc#945493)
• Restarting openssh with openssh-fips installed was not working correctly (bsc#945484)
• Fix crashes when /proc is not available in the chroot (bsc#947458)
• Correctly parse GSSAPI KEX algorithms (bsc#961368)
• More verbose FIPS mode/CC related documentation in README.FIPS (bsc#965576, bsc#960414)
• Fix PRNG re-seeding (bsc#960414, bsc#729190)
• Disable DH parameters under 2048 bits by default and allow lowering the limit back to the RFC 4419 specified minimum through an option (bsc#932483, bsc#948902)

openssh was updated to fix three security issues.

These security issues were fixed:

• CVE-2016-3115: Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH allowed remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions (bsc#970632).
• CVE-2016-1908: Possible fallback from untrusted to trusted X11 forwarding (bsc#962313).
• CVE-2015-8325: Ignore PAM environment vars when UseLogin=yes (bsc#975865).

These non-security issues were fixed:

• Correctly parse GSSAPI KEX algorithms (bsc#961368)
• More verbose FIPS mode/CC related documentation in README.FIPS (bsc#965576, bsc#960414)
• Fix PRNG re-seeding (bsc#960414, bsc#729190)
• Disable DH parameters under 2048 bits by default and allow lowering the limit back to the RFC 4419 specified minimum through an option (bsc#932483, bsc#948902)
• Allow empty Match blocks (bsc#961494)

This update for OpenSSH fixes the following issues:

• Prevent user enumeration through the timing of password processing. (bsc#989363, CVE-2016-6210)
• Allow lowering the DH groups parameter limit in server as well as when GSSAPI key exchange is used. (bsc#948902)
• Sanitize input for xauth(1). (bsc#970632, CVE-2016-3115)
• Prevent X11 SECURITY circumvention when forwarding X11 connections. (bsc#962313, CVE-2016-1908)
• Disable DH parameters under 2048 bits by default and allow lowering the limit back to the RFC 4419 specified minimum through an option. (bsc#932483, bsc#948902)
• Ignore PAM environment when using login. (bsc#975865, CVE-2015-8325)
• Limit the accepted password length (prevents a possible denial of service). (bsc#992533, CVE-2016-6515)
• Relax version requires for the openssh-askpass sub-package. (bsc#962794)
• Avoid complaining about unset DISPLAY variable. (bsc#981654)
• Initialize message id to prevent connection breakups in some cases. (bsc#959096)

This update for openssh-openssl1 fixes the following issues:

Security issues fixed:

• CVE-2016-6210: Prevent user enumeration through the timing of password processing (bsc#989363)
• CVE-2016-6515: limit accepted password length (prevents possible DoS) (bsc#992533)
• CVE-2016-3115: Sanitise input for xauth(1) (bsc#970632)
• CVE-2016-1908: prevent X11 SECURITY circumvention when forwarding X11 connections (bsc#962313)
• CVE-2015-8325: ignore PAM environment when using login (bsc#975865)
• Disable DH parameters under 2048 bits by default and allow lowering the limit back to the RFC 4419 specified minimum through an option (bsc#932483, bsc#948902)
• Allow lowering the DH groups parameter limit in server as well as when GSSAPI key exchange is used (bsc#948902)

Bugs fixed:

• avoid complaining about unset DISPLAY variable (bsc#981654)
• Correctly parse GSSAPI KEX algorithms (bsc#961368)
• more verbose FIPS mode/CC related documentation in README.FIPS (bsc#965576, bsc#960414)
• fix PRNG re-seeding (bsc#960414, bsc#729190)
• Allow empty Match blocks (bsc#961494)

Shayan Sadigh discovered that OpenSSH incorrectly handled environment files when the UseLogin feature is enabled. A local attacker could use this issue to gain privileges. (CVE-2015-8325)

Ben Hawkes discovered that OpenSSH incorrectly handled certain network traffic. A remote attacker could possibly use this issue to cause OpenSSH to crash, resulting in a denial of service. This issue only applied to Ubuntu 15.10. (CVE-2016-1907)

Thomas Hoger discovered that OpenSSH incorrectly handled untrusted X11 forwarding when the SECURITY extension is disabled. A connection configured as being untrusted could get switched to trusted in certain scenarios, contrary to expectations. (CVE-2016-1908)

It was discovered that OpenSSH incorrectly handled certain X11 forwarding data. A remote authenticated attacker could possibly use this issue to bypass certain intended command restrictions. (CVE-2016-3115)