OpenSSH - Security Update
Summary
DSA-3446-1: openssh - security update. Affects openssh versions < 1:6.0p1-4+deb7u3. Fixed in 1:6.0p1-4+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is an implementation of the SSH protocol suite, providing secure remote login, file transfer, and tunneling capabilities. It consists of both a server and a client component. The OpenSSH client supports a feature called SSH roaming, which allows a client to resume a broken SSH connection at a later time if the server also supports it. However, the OpenSSH server does not support roaming. This vulnerability affects the OpenSSH client's roaming code.
Vulnerability Detail
The Qualys Security team discovered two vulnerabilities in the roaming code of the OpenSSH client. The first vulnerability, identified as CVE-2016-0777, allows a rogue SSH server to exploit an information leak (memory disclosure) and trick the client into leaking sensitive data from its memory, including private keys. The second vulnerability, identified as CVE-2016-0778, is a buffer overflow that can lead to a file descriptor leak. However, due to another bug in the code, it is possibly not exploitable under certain conditions. The buffer overflow vulnerability can be exploited by a rogue SSH server when using ProxyCommand, ForwardAgent, or ForwardX11, but this is not the default configuration.
How To Fix
Minimum fixed version
1:6.0p1-4+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, it is also possible to disable roaming by adding the option 'UseRoaming no' to the global /etc/ssh/ssh_config file, the user configuration in ~/.ssh/config, or by passing '-oUseRoaming=no' on the command line.
Conclusion
The OpenSSH client's roaming code contains two vulnerabilities that can be exploited by a rogue SSH server. It is recommended to upgrade the openssh packages to fix these vulnerabilities. If immediate upgrading is not possible, disabling roaming or updating passphrase-less private keys is advised. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for openssh →
FAQ
SSH roaming is a feature that allows a client to resume a broken SSH connection at a later time if the server also supports it. It is enabled by default in the OpenSSH client.
A rogue SSH server can exploit the CVE-2016-0777 vulnerability to trick the client into leaking sensitive data from its memory, including private keys. The CVE-2016-0778 vulnerability can lead to a file descriptor leak, but it is possibly not exploitable under certain conditions.
No, only the OpenSSH client's roaming code is affected. The OpenSSH server does not support roaming.
Users with passphrase-less private keys, especially in non-interactive setups, are advised to update their keys if they have connected to an SSH server they don't trust.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
