Denial of service in Oracle Linux and macOS - CVE-2016-0778

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU719

Denial of service in Oracle Linux and macOS - CVE-2016-0778

Published: October 3, 2016 / Updated: January 12, 2017


Vulnerability identifier: #VU719
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-0778
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to cause denial of service conditions on the target system.
The weakness is due to insufficient access control that allows attackers to cause the service deny.
Successful exploitation of the vulnerability leads to denial of service on the vulnerable system.

Affected software

Oracle Linux
macOS
Arch Linux
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Fedora
Red Hat Enterprise Linux EUS Compute Node
SUSE Linux
Ubuntu
Slackware Linux
openssh (Debian package)
openssh (Alpine package)
gsi-openssh
QLogic Virtual Fabric Extension Module for IBM BladeCenter
Flex System FC3171 8Gb SAN Pass-thru
Flex System FC3171 8Gb SAN Switch
XIV Storage System Gen2
XIV Gen3

How to mitigate CVE-2016-0778


openssh (Debian package) - addressed in versions 1:6.0p1-4+deb7u3, 1:6.7p1-5+deb8u1
openssh (Alpine package) - update to 6.6_p1-r7
gsi-openssh - addressed in versions 6.6.1p1-3.el7, 6.9p1-7.fc22, 7.1p2-1.fc23
QLogic Virtual Fabric Extension Module for IBM BladeCenter - update to 9.0.3.16.00
Flex System FC3171 8Gb SAN Pass-thru - update to 9.1.8.01.00
Flex System FC3171 8Gb SAN Switch - update to 9.1.8.01.00
XIV Storage System Gen2 - addressed in versions 10.2.4.e-5, 10.2.4.e-8
XIV Gen3 - addressed in versions 11.4.2.a, 11.4.2.d, 11.5.2.a, 11.5.2, 11.6.1.a, 11.6.1

External References

Related Security Bulletins