Null pointer dereference in OpenSSH - CVE-2016-10708

Vulnerability identifier: #VU14163

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-10708

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to improper processing of out-of-sequence NEWKEYS messages, as defined in the kex.c and packet.c source code files. A remote attacker can send an out-of-sequence NEWKEYS message, trigger a NULL pointer dereference condition and cause the sshd daemon to crash.

OpenSSH
SCALANCE X302-7 EEC
SCALANCE X307-2 EEC
SCALANCE X306-1LD FE
SCALANCE X304-2FE
SCALANCE X204 IRT PRO
SCALANCE X204 IRT
SCALANCE X200-4P IRT
SCALANCE X201-3P IRT
SCALANCE X201-3P IRT PRO
SCALANCE X202-2 IRT
SCALANCE X202-2P IRT
SCALANCE X202-2P IRT PRO
SCALANCE XF204-2BA IRT
SCALANCE XF204 IRT
SCALANCE XF202-2P IRT
SCALANCE XF201-3P IRT
SCALANCE X408-2
SCALANCE X320-1-2LD FE
SCALANCE X320-1 FE
SCALANCE X212-2
SCALANCE XF208
SCALANCE XF206-1
SCALANCE XF204-2
SCALANCE XF204
SCALANCE X224
SCALANCE X216
SCALANCE X212-2LD
SCALANCE X208PRO
SCALANCE X208
SCALANCE X206-1LD
SCALANCE X206-1
SCALANCE X204-2TS
SCALANCE X204-2LD TS
SCALANCE X204-2LD
SCALANCE X204-2FM
SCALANCE X204-2
SCALANCE XR324-12M
SCALANCE XR324-4M POE TS
SCALANCE XR324-4M POE
SCALANCE XR324-4M EEC
SCALANCE X307-3LD
SCALANCE X307-3
SCALANCE X308-2
SCALANCE X310
SCALANCE X310FE
SCALANCE XR324-12M TS
SCALANCE X308-2M TS
SCALANCE X308-2M POE
SCALANCE X308-2M
SCALANCE X308-2LH+
SCALANCE X308-2LH
SCALANCE X308-2LD
BIG-IP
openssh (Debian package)
openssh (Ubuntu package)
openssh-server (Ubuntu package)
Ubuntu
Opensuse
Dynamic System Analysis (DSA) Preboot
Integrated Management Module II (IMM2) for BladeCenter Systems
Flex System Integrated Management Module (IMM2)
System x Integrated Management Module (IMM2)
Flex System Chassis Management Module (CMM)

Update to version 7.4.

OpenSSH - update to 7.4p1
BIG-IP - update to 14.1.0
openssh (Debian package) - addressed in versions 1:6.0p1-4+deb7u7, 1:6.7p1-5+deb8u6, 1:7.4p1-1
openssh (Ubuntu package) - addressed in versions 1:6.6p1-2ubuntu2.11, 1:7.2p2-4ubuntu2.6, 1:7.6p1-4ubuntu0.1
Dynamic System Analysis (DSA) Preboot - update to dsyte2z-9.65
Flex System Integrated Management Module (IMM2) - update to 1AOO86D-7.00
System x Integrated Management Module (IMM2) - update to 1AOO86D-7.00
Integrated Management Module II (IMM2) for BladeCenter Systems - update to 1AOO86D-7.00-bc
Flex System Chassis Management Module (CMM) - update to 2pet16d-2.5.13d
SCALANCE X212-2 - update to 5.2.5
SCALANCE XF208 - update to 5.2.5
SCALANCE XF206-1 - update to 5.2.5
SCALANCE XF204-2 - update to 5.2.5
SCALANCE XF204 - update to 5.2.5
SCALANCE X224 - update to 5.2.5
SCALANCE X216 - update to 5.2.5
SCALANCE X212-2LD - update to 5.2.5
SCALANCE X208PRO - update to 5.2.5
SCALANCE X208 - update to 5.2.5
SCALANCE X206-1LD - update to 5.2.5
SCALANCE X206-1 - update to 5.2.5
SCALANCE X204-2TS - update to 5.2.5
SCALANCE X204-2LD TS - update to 5.2.5
SCALANCE X204-2LD - update to 5.2.5
SCALANCE X204-2FM - update to 5.2.5
SCALANCE X204-2 - update to 5.2.5
openssh-server (Ubuntu package) - update to 1:7.6p1-4ubuntu0.5

• https://www.openssh.com/releasenotes.html

• Denial of service in OpenSSH
• OpenSUSE Linux update for openssh
• Debian update for openssh
• Ubuntu update for OpenSSH
• Multiple vulnerabilities in Siemens SCALANCE X-200 and X-300/X408 Switches
• Ubuntu update for openssh
• F5 BIG-IP update for OpenSSL
• Multiple vulnerabilities in IBM Dynamic System Analysis (DSA) Preboot
• Multiple vulnerabilities in IBM Integrated Management Module II (IMM2)
• Multiple vulnerabilities in IBM Flex System Chassis Management Module (CMM)