Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 506
Alerts This Week
Warning Icon 1 506

Ubuntu 15.10 OpenSSH Advisory USN-2966-1: Serious DoS and Escalation Risks

ubuntu
Calendar Grey May 9, 2016
Scroller Ubuntu
Various vulnerabilities in OpenSSH for Ubuntu have been resolved with appropriate patches; make sure your system is protected.
Several security issues were fixed in OpenSSH.

Summary

Several security issues were fixed in OpenSSH.

Software Description:

- openssh: secure shell (SSH) for secure access to remote machines

Details:

Shayan Sadigh discovered that OpenSSH incorrectly handled environment files

when the UseLogin feature is enabled. A local attacker could use this issue

to gain privileges. (CVE-2015-8325)

Ben Hawkes discovered that OpenSSH incorrectly handled certain network

traffic. A remote attacker could possibly use this issue to cause OpenSSH

to crash, resulting in a denial of service. This issue only applied to

Ubuntu 15.10. (CVE-2016-1907)

Thomas Hoger discovered that OpenSSH incorrectly handled untrusted X11

forwarding when the SECURITY extension is disabled. A connection configured

as being untrusted could get switched to trusted in certain scenarios,

contrary to expectations. (CVE-2016-1908)

It was discovered that OpenSSH incorrectly handled certain X11 forwarding

data. A remote authenticated attacker could possibly u...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory privilege escalation DoS security fix Ubuntu OpenSSH different distributions

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
  openssh-server                  1:6.9p1-2ubuntu0.2

Ubuntu 14.04 LTS:
  openssh-server                  1:6.6p1-2ubuntu2.7

Ubuntu 12.04 LTS:
  openssh-server                  1:5.9p1-5ubuntu1.9

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2966-1

CVE-2015-8325, CVE-2016-1907, CVE-2016-1908, CVE-2016-3115

Severity
critical
Lowest
Low
Medium
High
Critical

May 09, 2016

Topics%20covered

Topics Covered

security advisory privilege escalation DoS security fix Ubuntu OpenSSH different distributions

Package Information

https://launchpad.net/ubuntu/+source/openssh/1:6.9p1-2ubuntu0.2
https://launchpad.net/ubuntu/+source/openssh/1:6.6p1-2ubuntu2.7
https://launchpad.net/ubuntu/+source/openssh/1:5.9p1-5ubuntu1.9

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.