high CVSS 7.5 EPSS 36% Public exploit available

CVE-2016-3115·OpenSSH vulnerability

Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.

Severity
high
Software
OpenSSH
Fixed in
1:7.2p2-1
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 36% — in the top 2% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

Until: 1:7.2p2-1

Fixed in: 1:7.2p2-1

How to fix this CVE

Update OpenSSH server to version 7.2p2-1 or later to patch CRLF injection vulnerabilities in X11 forwarding handling. These vulnerabilities allow authenticated users to bypass shell-command restrictions through malformed X11 forwarding data. Immediate patching is recommended for systems that permit X11 forwarding, especially in multi-user environments.

sudo dnf update openssh-server && sudo systemctl restart sshd

Defensia detects this vulnerability

How to check if you are affected

  1. Run 'ssh -V' or 'sshd -v' to check the installed OpenSSH version; vulnerable versions are below 7.2p2
  2. Verify X11 forwarding is enabled by checking 'X11Forwarding' in /etc/ssh/sshd_config; if set to 'yes', the service is potentially exploitable
  3. Search SSH logs for anomalous X11 forwarding requests: grep -i 'x11' /var/log/auth.log | grep -i 'forwarding'
  4. Confirm the patch was applied by running 'ssh -V' again and verifying the version is 7.2p2-1 or later

FAQ

What is CVE-2016-3115?

CVE-2016-3115 is a CRLF injection flaw in OpenSSH's X11 forwarding implementation that allows authenticated attackers to inject carriage return/line feed characters into session handling, bypassing command restrictions that would normally be enforced by the SSH server.

Is CVE-2016-3115 being actively exploited?

CVE-2016-3115 is not listed as actively exploited by CISA; however, public proof-of-concept exploits are available, so the vulnerability remains a concern for systems that have not been patched.

What versions of OpenSSH are affected by CVE-2016-3115?

All versions of OpenSSH prior to 7.2p2 are vulnerable. This includes 7.1, 7.0, and all earlier versions that support X11 forwarding.

How do I check if my server is vulnerable to CVE-2016-3115?

Run 'ssh -V' to display the OpenSSH version; if it is below 7.2p2 and X11Forwarding is enabled in /etc/ssh/sshd_config, your server is vulnerable.

Does Defensia detect CVE-2016-3115?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If OpenSSH is installed on a monitored server, CVE-2016-3115 will appear in your dashboard with remediation steps.

Related OpenSSH CVEs

CVE-2008-0166CVSS 9OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.
CVE-2016-6515CVSS 9The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
CVE-2016-10009CVSS 8.5Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.
CVE-2016-6210CVSS 8.5sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.
CVE-2018-15473CVSS 8.5OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2016-3115. Free for 1 server.

Get started free