CVE-2016-10009: High severity OpenBSD OpenSSH vulnerability
It was found that ssh-agent could load PKCS#11 modules from paths outside of a trusted whitelist. An attacker able to load a crafted PKCS#11 module across a forwarded agent channel could potentially use this flaw to execute arbitrary code on the system running the ssh-agent. Note that the attacker must have control of the forwarded agent-socket and the ability to write to the filesystem of the host running ssh-agent.
This issue was fixed by only allowing the loading of module from a trusted (and configurable) whitelist.
CVE assignment:
http://seclists.org/oss-sec/2016/q4/708
Upstream patch:
http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/ssh-agent.c.diff?r1=1.214&r2=1.215&sortby=date&f=h
Other sources
Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/opensshto a version that resolves this vulnerability.Fixed in 7.4 - Upgrade
Upgrade
debian/opensshto a version that resolves this vulnerability.Fixed in 1:8.4p1-5+deb11u3Fixed in 1:8.4p1-5+deb11u7Fixed in 1:9.2p1-2+deb12u10Fixed in 1:9.2p1-2+deb12u9Fixed in 1:10.0p1-7+deb13u4Fixed in 1:10.0p1-7+deb13u2Fixed in 1:10.3p1-4 - Upgrade
Upgrade
OpenSSHto a version that resolves this vulnerability.Fixed in 7.4
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10009?
CVE-2016-10009 is classified as a high severity vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2016-10009?
To fix CVE-2016-10009, upgrade OpenSSH to version 7.4 or later on affected systems.
What does CVE-2016-10009 exploit?
CVE-2016-10009 exploits an untrusted search path vulnerability in ssh-agent allowing remote execution of malicious local PKCS#11 modules.
Which versions of OpenSSH are affected by CVE-2016-10009?
OpenSSH versions prior to 7.4 are affected by CVE-2016-10009.
What type of attacks can be facilitated by CVE-2016-10009?
CVE-2016-10009 can facilitate remote attacks allowing unauthorized access and execution of local code through agent forwarding.