CVE-2016-0777

MEDIUM

OpenSSH <7.1p2 - Info Disclosure

Title source: llm
STIX 2.1

Description

The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key.

Exploits (2)

nomisec WRITEUP
by Abdirisaq-ali-aynab · poc
https://github.com/Abdirisaq-ali-aynab/vulnerability-assessment
nomisec WRITEUP
by Abdirisaq-ali-aynab · poc
https://github.com/Abdirisaq-ali-aynab/openssh-vulnerability-assessment

References (34)

Core 34
Core References
Mailing List, Third Party Advisory vendor-advisory
http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html
Third Party Advisory, VDB Entry mailing-list
http://www.securityfocus.com/archive/1/537295/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry
http://www.securityfocus.com/bid/80695
Mailing List, Third Party Advisory vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00014.html
Third Party Advisory, VDB Entry vdb-entry
http://www.securitytracker.com/id/1034671
Mailing List, Third Party Advisory vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00013.html
Third Party Advisory vendor-advisory
https://security.gentoo.org/glsa/201601-01
Mailing List, Third Party Advisory mailing-list
http://www.openwall.com/lists/oss-security/2016/01/14/7
Mailing List, Third Party Advisory mailing-list
http://seclists.org/fulldisclosure/2016/Jan/44
Mailing List, Third Party Advisory vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00008.html
Mailing List, Third Party Advisory vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00007.html
Mailing List, Third Party Advisory vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00009.html
Third Party Advisory vendor-advisory
http://www.ubuntu.com/usn/USN-2869-1
Third Party Advisory vendor-advisory
http://www.debian.org/security/2016/dsa-3446
Mailing List, Third Party Advisory vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00006.html
Third Party Advisory
https://support.apple.com/HT206167

Scores

CVSS v3 6.5
EPSS 0.6720
EPSS Percentile 98.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-200
Status published
Products (27)
apple/mac_os_x < 10.11.3
hp/remote_device_access_virtual_customer_access_system < 15.07
openbsd/openssh 5.0 (2 CPE variants)
openbsd/openssh 5.1 (2 CPE variants)
openbsd/openssh 5.2 (2 CPE variants)
openbsd/openssh 5.3 (2 CPE variants)
openbsd/openssh 5.4 (2 CPE variants)
openbsd/openssh 5.5 (2 CPE variants)
openbsd/openssh 5.6 (2 CPE variants)
openbsd/openssh 5.7 (2 CPE variants)
... and 17 more
Published Jan 14, 2016
Tracked Since Feb 18, 2026