CVE-2016-1908

CRITICAL

OpenSSH <7.2 - Privilege Escalation

Title source: llm

Description

The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.

References (12)

Scores

CVSS v3 9.8
EPSS 0.0254
EPSS Percentile 85.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-287
Status draft

Affected Products (25)

openbsd/openssh < 7.2
debian/debian_linux
oracle/linux
oracle/linux
redhat/enterprise_linux_desktop
redhat/enterprise_linux_desktop
redhat/enterprise_linux_eus
redhat/enterprise_linux_eus
redhat/enterprise_linux_eus
redhat/enterprise_linux_eus
redhat/enterprise_linux_eus
redhat/enterprise_linux_eus
redhat/enterprise_linux_server
redhat/enterprise_linux_server
redhat/enterprise_linux_server_aus
... and 10 more

Timeline

Published Apr 11, 2017
Tracked Since Feb 18, 2026