NVD

Id
18973  
Name
CVE-2016-3115  
Description
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.  
Reject
 
CVSS Version
2  
CVSS Score
5.5  
Severity
Medium  
CVSS Base Score
5.5  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:P/A:N)  
Pub Date
2017-01-19  
Published
2016-03-22  
Modified Date
2016-12-02  
Seq
2016-3115  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
105132 18973 CVE-2016-3115 http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/session.c  View
105133 18973 CVE-2016-3115 http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/session.c.diff?r1=1.281&r2=1.282&f=h  View
105134 18973 CVE-2016-3115 FEDORA-2016-fc1cc33e05  View
105135 18973 CVE-2016-3115 FEDORA-2016-188267b485  View
105136 18973 CVE-2016-3115 FEDORA-2016-bb59db3c86  View
105137 18973 CVE-2016-3115 FEDORA-2016-0bcab055a7  View
105138 18973 CVE-2016-3115 FEDORA-2016-d339d610c1  View
105139 18973 CVE-2016-3115 FEDORA-2016-08e5803496  View
105140 18973 CVE-2016-3115 http://packetstormsecurity.com/files/136234/OpenSSH-7.2p1-xauth-Command-Injection-Bypass.html  View
105141 18973 CVE-2016-3115 RHSA-2016:0466  View
105142 18973 CVE-2016-3115 20160314 CVE-2016-3115 - OpenSSH <=7.2p1 xauth injection  View
105143 18973 CVE-2016-3115 20160314 CVE-2016-3116 - Dropbear SSH xauth injection  View
105144 18973 CVE-2016-3115 http://www.openssh.com/txt/x11fwd.adv  View
105145 18973 CVE-2016-3115 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html  View
105146 18973 CVE-2016-3115 http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html  View
105147 18973 CVE-2016-3115 http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html  View
105148 18973 CVE-2016-3115 84314  View
105149 18973 CVE-2016-3115 1035249  View
105150 18973 CVE-2016-3115 https://bto.bluecoat.com/security-advisory/sa121  View
105151 18973 CVE-2016-3115 https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115  View
105152 18973 CVE-2016-3115 39569  View
105153 18973 CVE-2016-3115 FreeBSD-SA-16:14  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
1062 JVNDB-2016-001835 OpenSSH の sshd の session.c における CRLF インジェクションの脆弱性 OpenSSH の sshd の session.c には、(1) do_authenticated1 および (2) session_x11_req 関数に関する処理に不備があるため、CRLF インジェクションの脆弱性が存在します。 CVE-2016-3115 89621 CVE-2016-3115 18973 5.5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-001835.html 2016-03-09 2016-11-17 View