CVE-2016-1908 in OpenBSD OpenSSH
Sumário (Inglês)
The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.
Reservar
15/01/2016
Divulgação
11/04/2017
Inscrições
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerabilidade | CWE | Exp | Con | CVE |
|---|---|---|---|---|---|
| 80656 | OpenBSD OpenSSH X11 Forwarding Elevação de Privilégios | 254 | Não provado | Correção oficial | CVE-2016-1908 |