high CVSS 8.5 EPSS 37% Public exploit available

CVE-2016-10009·OpenSSH vulnerability

Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.

Severity
high
Software
OpenSSH
Fixed in
1:7.4p1-1
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 37% — in the top 2% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

Until: 1:7.4p1-1

Fixed in: 1:7.4p1-1

How to fix this CVE

Update OpenSSH to version 7.4p1-1 or later to patch a critical agent socket vulnerability that could allow unauthorized PKCS#11 module loading. This vulnerability affects ssh-agent and requires immediate patching on all systems running affected versions. After updating, restart the SSH service to ensure the fix is active.

sudo dnf update openssh-server openssh-clients

Defensia detects this vulnerability

How to check if you are affected

  1. Check current OpenSSH version: ssh -V or sshd -v
  2. Verify ssh-agent is running: ps aux | grep ssh-agent
  3. Check if SSH_AUTH_SOCK environment variable is set and forwarded: echo $SSH_AUTH_SOCK and netstat -tlnp | grep ssh
  4. After patching, confirm version with ssh -V and restart SSH: sudo systemctl restart ssh (Debian/Ubuntu) or sudo systemctl restart sshd (RHEL/CentOS/Amazon Linux)

FAQ

What is CVE-2016-10009?

CVE-2016-10009 is a path traversal vulnerability in OpenSSH's ssh-agent that permits attackers to load arbitrary PKCS#11 security modules through a compromised or forwarded agent socket, potentially leading to credential theft or unauthorized key operations.

Is CVE-2016-10009 being actively exploited?

According to CISA, CVE-2016-10009 is not currently listed in the Known Exploited Vulnerabilities catalog; however, public exploits are available and the vulnerability requires agent forwarding to be in use.

What versions of OpenSSH are affected by CVE-2016-10009?

All OpenSSH versions prior to 7.4p1-1 are vulnerable. This includes OpenSSH 7.3 and earlier versions commonly deployed across enterprise environments.

How do I check if my server is vulnerable to CVE-2016-10009?

Run ssh -V to display your version. If the version is below 7.4p1-1, your system is vulnerable. Additionally, check if agent forwarding is enabled in sshd_config by examining: grep -i 'AllowAgentForwarding' /etc/ssh/sshd_config

Does Defensia detect CVE-2016-10009?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If OpenSSH is installed on a monitored server, CVE-2016-10009 will appear in your dashboard with remediation steps.

Related OpenSSH CVEs

CVE-2016-6515CVSS 9The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
CVE-2008-0166CVSS 9OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.
CVE-2016-6210CVSS 8.5sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.
CVE-2018-15473CVSS 8.5OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
CVE-2024-6387CVSS 8.1A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2016-10009. Free for 1 server.

Get started free