CVE-2016-1908
- ULN >
- Oracle Linux CVE repository >
- CVE-2016-1908
CVE Details
| Release Date: | 2016-01-14 | |
| Impact: | Moderate | What is this? |
Description
The client in OpenSSH before 7.2 mishandles failed cookie generationfor untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.
See more information about CVE-2016-1908 from MITRE CVE dictionary and NIST NVD
NOTE: The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v2 metrics
| Base Score: | 4.9 |
| Vector String: | AV:N/AC:M/Au:S/C:P/I:P/A:N |
| Version: | 2.0 |
| Attack Vector: | Network |
| Attack Complexity: | Medium |
| Authentication: | Single |
| Confidentiality Impact: | Partial |
| Integrity Impact: | Partial |
| Availability Impact: | None |
Errata information
| Platform | Errata | Release Date |
| Oracle Linux version 6 (openssh) | ELSA-2016-0741 | 2016-05-12 |
| Oracle Linux version 7 (openssh) | ELSA-2016-0465 | 2016-03-21 |
| Oracle VM version 3.3 (openssh) | OVMSA-2016-0048 | 2016-05-13 |
| Oracle VM version 3.4 (openssh) | OVMSA-2016-0048 | 2016-05-13 |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections:
- Oracle customers - enter a support request
- Vulnerability scanning tools vendors and project maintainers - follow the standard ISV process
