CVE

Id
87035  
CVE No.
CVE-2016-0739  
Status
Candidate  
Description
libssh before 0.7.3 improperly truncates ephemeral secrets generated for the (1) diffie-hellman-group1 and (2) diffie-hellman-group14 key exchange methods to 128 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."  
Phase
Assigned (20151216)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
761820 87035 CVE-2016-0739 CONFIRM:https://www.libssh.org/2016/02/23/libssh-0-7-3-security-and-bugfix-release/  View
761821 87035 CVE-2016-0739 CONFIRM:https://www.libssh.org/security/advisories/CVE-2016-0739.txt  View
761822 87035 CVE-2016-0739 DEBIAN:DSA-3488  View
761823 87035 CVE-2016-0739 URL:http://www.debian.org/security/2016/dsa-3488  View
761824 87035 CVE-2016-0739 FEDORA:FEDORA-2016-d9f950c779  View
761825 87035 CVE-2016-0739 URL:http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178058.html  View
761826 87035 CVE-2016-0739 FEDORA:FEDORA-2016-dc9e8da03c  View
761827 87035 CVE-2016-0739 URL:http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178822.html  View
761828 87035 CVE-2016-0739 GENTOO:GLSA-201606-12  View
761829 87035 CVE-2016-0739 URL:https://security.gentoo.org/glsa/201606-12  View
761830 87035 CVE-2016-0739 REDHAT:RHSA-2016:0566  View
761831 87035 CVE-2016-0739 URL:http://rhn.redhat.com/errata/RHSA-2016-0566.html  View
761832 87035 CVE-2016-0739 SUSE:openSUSE-SU-2016:0880  View
761833 87035 CVE-2016-0739 URL:http://lists.opensuse.org/opensuse-updates/2016-03/msg00111.html  View
761834 87035 CVE-2016-0739 UBUNTU:USN-2912-1  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
1035 JVNDB-2016-001808 Android の Telephony の internal/telephony/PhoneSubInfoController.java における重要な情報を取得される脆弱性 Android の Telephony の internal/telephony/PhoneSubInfoController.java の getDeviceIdForPhone 関数は、READ_PHONE_STATE パーミッションをチェックしないため、重要な情報を取得される脆弱性が存在します。 CVE-2016-0831 87035 4.3 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-001808.html  View