OpenSSH 拒绝服务漏洞

漏洞信息详情

OpenSSH 拒绝服务漏洞

CNNVD编号：CNNVD-201601-250
危害等级：高危-->
危害等级：高危
CVE编号： CVE-2016-0778
漏洞类型：缓冲区错误
发布时间： 2016-01-15
威胁类型：远程
更新时间： 2019-12-30
厂商： sophos
漏洞来源：

漏洞简介

OpenSSH（OpenBSD Secure Shell）是OpenBSD计划组所维护的一套用于安全访问远程计算机的连接工具。该工具是SSH协议的开源实现，支持对所有的传输进行加密，可有效阻止窃听、连接劫持以及其他网络级的攻击。

OpenSSH的客户端中的roaming_common.c文件中的‘roaming_read’和‘roaming_write’函数中存在安全漏洞，该漏洞源于程序启用特定的代理和转发选项时，没有正确保持连接文件描述符。远程攻击者可通过发送多个转发请求利用该漏洞造成拒绝服务（基于堆的缓冲区溢出）。以下版本受到影响：OpenSSH 5.x版本，6.x版本，7.1p2之前7.x版本。

漏洞公告

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接：

http://www.openssh.com/txt/release-7.1p2

参考网址

来源:SUSE

链接:http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00013.html

来源:DEBIAN

链接:https://www.debian.org/security/2016/dsa-3446

来源:DEBIAN

链接:http://www.debian.org/security/2016/dsa-3446

来源:CONFIRM

链接:https://support.apple.com/HT206167

来源:CONFIRM

链接:https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/

来源:BUGTRAQ

链接:http://www.securityfocus.com/archive/1/537295/100/0/threaded

来源:BID

链接:https://www.securityfocus.com/bid/80698

来源:MISC

链接:https://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-Overflow-Leak.html

来源:MISC

链接:http://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-Overflow-Leak.html

来源:CONFIRM

链接:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375

来源:FEDORA

链接:http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176349.html

来源:SUSE

链接:http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00007.html

来源:APPLE

链接:http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html

来源:SECTRACK

链接:http://www.securitytracker.com/id/1034671

来源:FULLDISC

链接:http://seclists.org/fulldisclosure/2016/Jan/44

来源:CONFIRM

链接:http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html

来源:CONFIRM

链接:http://www.openssh.com/txt/release-7.1p2

来源:GENTOO

链接:https://security.gentoo.org/glsa/201601-01

来源:FEDORA

链接:http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176516.html

来源:MLIST

链接:http://www.openwall.com/lists/oss-security/2016/01/14/7

来源:CONFIRM

链接:https://bto.bluecoat.com/security-advisory/sa109

来源:SUSE

链接:http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00006.html

来源:SUSE

链接:http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00009.html

来源:SUSE

链接:http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00014.html

来源:CONFIRM

链接:https://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/

来源:CONFIRM

链接:http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

来源:CONFIRM

链接:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388

来源:CONFIRM

链接:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680

来源:SUSE

链接:http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00008.html

来源:UBUNTU

链接:http://www.ubuntu.com/usn/USN-2869-1

来源:CONFIRM

链接:http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734

来源:BID

链接:http://www.securityfocus.com/bid/80698

来源:CONFIRM

链接:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722

受影响实体

Sophos Unified_threat_management_software:9.353

补丁

OpenSSH 拒绝服务漏洞的修复措施

正文

OpenSSH 拒绝服务漏洞

漏洞信息详情