Published: 22/03/2016 Updated: 11/09/2018

CVSS v2 Base Score: 5.5 | Impact Score: 4.9 | Exploitability Score: 8

CVSS v3 Base Score: 6.4 | Impact Score: 2.7 | Exploitability Score: 3.1

VMScore: 556

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N

Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH prior to 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openbsd openssh
oracle vm server 3.2

Several security issues were fixed in OpenSSH ...

It was discovered that the OpenSSH server did not sanitize data received in requests to enable X11 forwarding An authenticated client with restricted SSH access could possibly use this flaw to bypass intended restrictions ...

''' Author: <githubcom/tintinweb> Ref: githubcom/tintinweb/pub/tree/master/pocs/cve-2016-3115 Version: 02 Date: Mar 3rd, 2016 Tag: openssh xauth command injection may lead to forced-command and /bin/false bypass Overview -------- Name: openssh Vendor: OpenBSD References: * ...

BlackStratus LOGStorm has multiple vulnerabilities that allow a remote unauthenticated user, among other things, to assume complete control over the virtual appliance with root privileges This is possible due to multiple network servers listening for network connections by default, allowing authorization with undocumented credentials supported by ...

OpenSSH versions 72p1 and below suffer from a command injection and /bin/false bypass vulnerability via xauth ...

Support This is a community project and while you will see contributions from the Deep Security team, there is no official Trend Micro support for this project The official documentation for the Deep Security APIs is available from the Trend Micro Online Help Centre Tutorials, feature-specific help, and other information about Deep Security is available from the Deep Security

Scripts used to combine Qualys scans and Trend Micro Deep Security recommendation scan results into reports.

Support This is a community project and while you will see contributions from the Deep Security team, there is no official Trend Micro support for this project The official documentation for the Deep Security APIs is available from the Trend Micro Online Help Centre Tutorials, feature-specific help, and other information about Deep Security is available from the Deep Security

NVD-CWE-Other http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/session.c.diff?r1=1.281&r2=1.282&f=h http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/session.c http://www.openssh.com/txt/x11fwd.adv http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securityfocus.com/bid/84314 http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184264.html http://rhn.redhat.com/errata/RHSA-2016-0466.html http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178838.html http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180491.html http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183122.html http://seclists.org/fulldisclosure/2016/Mar/46 http://seclists.org/fulldisclosure/2016/Mar/47 http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183101.html https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115 http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179924.html https://www.exploit-db.com/exploits/39569/https://www.freebsd.org/security/advisories/FreeBSD-SA-16:14.openssh.asc https://bto.bluecoat.com/security-advisory/sa121 http://packetstormsecurity.com/files/136234/OpenSSH-7.2p1-xauth-Command-Injection-Bypass.html http://www.securitytracker.com/id/1035249 https://security.gentoo.org/glsa/201612-18 http://rhn.redhat.com/errata/RHSA-2016-0465.html https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html https://usn.ubuntu.com/2966-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/39569/

CVE-2016-3115

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect