Security OpenSSH Security Bug CVE-2016-0777 & CVE-2016-0778

eva2000 · Jan 15, 2016

OpenSSH client end security vulnerability posted on WHT forums at OpenSSH: client bug CVE-2016-0777. Related to CVE-2016-0777 and CVE-2016-0778

Workaround

For CentOS 7.x only, workaround for now until OpenSSH gets updated by Redhat/CentOS, is disabling UseRoaming in ssh client config file by adding (appending) the variable to end of the ssh_config file
Code:
echo 'UseRoaming no' >> /etc/ssh/ssh_config
or for SSH client end

or start your ssh client with -oUseRoaming=no included on the command line
Click to expand...

Other info links

CVE-2016-0777 - Red Hat Customer Portal - only affects Redhat/CentOS 7 in non-default configurations. Redhat/CentOS 4, 5, and 6 not affected

OpenSSH: Information-leak vulnerability (CVE-2016-0777) - Red Hat Customer Portal

CVE-2016-0778 - Red Hat Customer Portal ! again only Redhat/CentOS 7 affected

OpenSSH Client Bug CVE-2016-0777 and CVE-2016-0778 | DigitalOcean

https://www.qualys.com/2016/01/14/c...-0778/openssh-cve-2016-0777-cve-2016-0778.txt

Updated OpenSSH packages

Redhat 7 openssh updated packages have been released Red Hat Customer Portal
Code:
x86_64:
openssh-6.6.1p1-23.el7_2.x86_64.rpm        MD5: 4107b3d61b0b4d19fd75cffad0e1edc9
SHA-256: 02d5c25c03028e6588712df36cfae11a67ce0c1d82053793fbec018b55f04b81
openssh-askpass-6.6.1p1-23.el7_2.x86_64.rpm        MD5: 67d38d185180f37a555f9da72e350bd0
SHA-256: c08b486cb3457d13f67bdbac0b526b9d82225da2afb1b8e65658492a33e843b7
openssh-clients-6.6.1p1-23.el7_2.x86_64.rpm        MD5: 58efb3d2a957c648d614bd138c24feba
SHA-256: 7bf43948bf45a903398ba8bfb1959790138903047d21a0e7ed1b3a269ddcbf65
openssh-debuginfo-6.6.1p1-23.el7_2.i686.rpm        MD5: 4573e92cc76a0e44b347872db97f39d3
SHA-256: 0911be36881144e368b2b3e50933fcc024a7c708c9552327ac433b9e23438abb
openssh-debuginfo-6.6.1p1-23.el7_2.x86_64.rpm        MD5: 21e96ad2ca7a1445c29a5f55ddf173fc
SHA-256: 2495f2fbaf4f04e62e32ea1c2bcb3b1c084dafe9a50a9831844c9f1921546266
openssh-keycat-6.6.1p1-23.el7_2.x86_64.rpm        MD5: 03f8800c1e572738f8cddb583a5c2e69
SHA-256: 3ec6f587eec4ed7862ede492ed56b2c8253892e2a2c1441b7a0b473036e982db
openssh-ldap-6.6.1p1-23.el7_2.x86_64.rpm        MD5: bd612582cdba007dd6e1d1fa23f0ae86
SHA-256: afa29af34b161058475ef03f712eeaec73780ea781c217d6d5cb1362ce32851b
openssh-server-6.6.1p1-23.el7_2.x86_64.rpm        MD5: 657a6e2905519d719213faf61709b4d9
SHA-256: 057db9c007eed0a70b0ae77837d19566f2f36c83cdbbcd5a3545c30af99eca43
openssh-server-sysvinit-6.6.1p1-23.el7_2.x86_64.rpm        MD5: 187cc40d72ffd3045425aba0f0780974
SHA-256: f830fe2abf109d195545716e6844385ada6f240f0e04d54dbbe5df21fa8f8535
pam_ssh_agent_auth-0.9.3-9.23.el7_2.i686.rpm        MD5: b7138a12fe05f4a97da642067f43ca29
SHA-256: 96c195fff319a3058bd3590244a2a03a107afb3435ff77c01e46fff63cee1811
pam_ssh_agent_auth-0.9.3-9.23.el7_2.x86_64.rpm        MD5: 29dd7de78c7d393ad2ac33a5d9036f2e
SHA-256: 3e464afd2da795562905c918a0f9571c2b6721a3f3f03f2965dfcc840849d5ee
For CentOS 7
Code:
yum -q list updates
Updated Packages
openssh.x86_64          6.6.1p1-23.el7_2                                                                                                       updates
openssh-clients.x86_64         6.6.1p1-23.el7_2                                                                                                       updates
openssh-server.x86_64         6.6.1p1-23.el7_2                                                                                                       updates
After update command
Code:
yum -y update
Code:
 yum -q list installed openssh*
Installed Packages
openssh.x86_64         6.6.1p1-23.el7_2                                                                                                      @updates
openssh-clients.x86_64         6.6.1p1-23.el7_2                                                                                                      @updates
openssh-server.x86_64         6.6.1p1-23.el7_2                                                                                                      @updates
openssh changelog
Code:
rpm -qa --changelog openssh | head -n4
* Wed Jan 13 2016 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-23 + 0.9.3-9
- Disable undocumented feauture Roaming for good (#1298218)
- prevents CVE-2016-0777 and CVE-2016-0778
* SECURITY: ssh(1): The OpenSSH client code between 5.4 and 7.1
contains experimential support for resuming SSH-connections (roaming).

The matching server code has never been shipped, but the client
code was enabled by default and could be tricked by a malicious
server into leaking client memory to the server, including private
client user keys.

The authentication of the server host key prevents exploitation
by a man-in-the-middle, so this information leak is restricted
to connections to malicious or compromised servers.

MITIGATION: For OpenSSH >= 5.4 the vulnerable code in the client
can be completely disabled by adding 'UseRoaming no' to the gobal
ssh_config(5) file, or to user configuration in ~/.ssh/config,
or by passing -oUseRoaming=no on the command line.
Click to expand...

negative · Jan 15, 2016

Thank you, applied

rdan · Jan 15, 2016

I have all my server as shortcut on my desktop only, and auto login on shell.
So commands for me

echo 'UseRoaming no' >> /etc/ssh/ssh_config
service sshd reload
logout
Click to expand...

eva2000 · Jan 15, 2016

Redhat's entry at CVE-2016-0777 - Red Hat Customer Portal

Looks like Redhat and thus CentOS 4, 5, 6 are not affected only Redhat and CentOS 7 and only in non-default configurations

CVE-2016-0777
Impact:
Moderate
Public Date:
2016-01-14
Bugzilla:
1298032: CVE-2016-0777 OpenSSH: Client Information leak due to use of roaming connection feature
The MITRE CVE dictionary describes this issue as:

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
Find out more about CVE-2016-0777 from the MITRE CVE dictionary dictionary and NIST NVD.

Statement
This issue does not affect the version OpenSSH as shipped with Red Hat Enterprise Linux 4, 5 and 6. This issue affects the version of OpenSSH as shipped with Red Hat Enterprise Linux 7 in a non-default configuration. For more information please refer to OpenSSH: Information-leak vulnerability (CVE-2016-0777) - Red Hat Customer Portal
Click to expand...

Mitigation

The vulnerable roaming code can be permanently disabled by adding the
undocumented option "UseRoaming no" to the system-wide configuration
file (usually /etc/ssh/ssh_config), or per-user configuration file
(~/.ssh/config), or command-line (-o "UseRoaming no").

If an OpenSSH client is disconnected from an SSH server that offers
roaming, it prints "[connection suspended, press return to resume]" on
stderr, and waits for '\n' or '\r' on stdin (and not on the controlling
terminal) before it reconnects to the server; advanced users may become
suspicious and press Control-C or Control-Z instead, thus avoiding the
information leak.

However, SSH commands that use the local stdin to transfer data to the
remote server are bound to trigger this reconnection automatically (upon
reading a '\n' or '\r' from stdin). Moreover, these non-interactive SSH
commands (for example, backup scripts and cron jobs) commonly employ
public-key authentication and are therefore perfect targets for this
information leak.
Click to expand...

eva2000 · Jan 15, 2016

from OpenSSH: Information-leak vulnerability (CVE-2016-0777) - Red Hat Customer Portal
Affected Products

Red Hat Enterprise Linux 4, 5, and 6 are not affected by this flaw because they include OpenSSH versions older than 5.4, and hence do not implement the roaming feature.

Red Hat Enterprise Linux 7 is affected by this flaw, but not in a default configuration. The current OpenSSH packages are based on version 6.6 and are vulnerable to this issue when used with certain ProxyCommands settings.

Red Hat Enterprise Linux 7 previously included OpenSSH version 6.4. That version was affected even when no ProxyCommand setting was used. The OpenSSH packages were updated from version 6.4 to version 6.6 in Red Hat Enterprise Linux 7.1 via RHSA-2015:0425.

Mitigation:
In Red Hat Enterprise Linux 7 you can mitigate this issue by setting the following option in the OpenSSH client's configuration file, either global (/etc/ssh/ssh_config) or user specific (~/.ssh/config):
Code:
UseRoaming no
The above directive should be placed in the Host * section of the configuration file to use this setting for all SSH servers the client connects to.

You can also set the option via a command line argument when connecting to an SSH server:
Code:
-o 'UseRoaming no'
Resolution:
Red Hat Product Security is currently working on security updates for Red Hat Enterprise Linux 7, and they should be available soon.
Click to expand...
Since version 5.4, the OpenSSH client supports an undocumented feature called roaming. If a connection to an SSH server breaks unexpectedly, and if the server supports roaming as well, the client is able to reconnect to the server and resume the interrupted SSH session. The roaming feature is enabled by default in OpenSSH clients, even though no OpenSSH server version implements the roaming feature.

An information leak flaw was found in the way OpenSSH client roaming feature was implemented. The information leak is exploitable in the default configuration of certain versions of the OpenSSH client and could (depending on the client's version, compiler, and operating system) allow a malicious SSH server to steal the client's private keys.

This issue has been assigned CVE-2016-0777, and was rated as having Moderate impact by Red Hat Product Security.

Note that this flaw can only be triggered after successful authentication and therefore can only be exploited by a malicious or compromised SSH server. Man-in-the-middle (MITM) attackers can not exploit this issue.
Click to expand...

eva2000 · Jan 15, 2016

Red Hat Enterprise Linux 7 is affected by this flaw, but not in a default configuration. The current OpenSSH packages are based on version 6.6 and are vulnerable to this issue when used with certain ProxyCommands settings
Click to expand...

CentOS 7.2 is using openssh 6.6.1p1-22
Code:
rpm -qa openssh
openssh-6.6.1p1-22.el7.x86_64
waiting for updated openssh package for CentOS 7 I guess
Code:
rpm -qa --changelog openssh | head -n5
* Fri Sep 25 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-22 + 0.9.3-9
- Use the correct constant for glob limits (#1160377)

* Thu Sep 24 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-21 + 0.9.3-9
- Extend memory limit for remote glob in sftp acc. to stat limit (#116037
no updates available in continuous release or fasttrack yum repos either
Code:
yum list updates --enablerepo=cr,fasttrack --disableplugin=priorities

Jimmy · Jan 15, 2016

Thanks for the heads up.

hardousse · Jan 15, 2016

Thank you, applied

rdan · Jan 15, 2016

WoW, very quick update from Linux Mint

eva2000 · Jan 15, 2016

oh there's a CVE-2016-0778 too CVE-2016-0778 - Red Hat Customer Portal ! again only Redhat/CentOS 7 affected

CVE-2016-0778
Impact:
Low
Public Date:
2016-01-14
Bugzilla:
1298033: CVE-2016-0778 OpenSSH: Client buffer-overflow when using roaming connections
A buffer overflow flaw was found in the way the OpenSSH client roaming feature was implemented. A malicious server could potentially use this flaw to execute arbitrary code on a successfully authenticated OpenSSH client if that client used certain non-default configuration options.

Find out more about CVE-2016-0778 from the MITRE CVE dictionary dictionary and NIST NVD.
Click to expand...

Sunka · Jan 15, 2016

Applied, thanks

eva2000 · Jan 15, 2016

Well according to the new Centmin Mod 2016 survey Centmin Mod Survey 2016 | Centmin Mod Community alot of folks are using CentOS 7, so hoping they're following this thread

eva2000 · Jan 15, 2016

Redhat 7 openssh updated packages have been released Red Hat Customer Portal

Code:

x86_64:
openssh-6.6.1p1-23.el7_2.x86_64.rpm        MD5: 4107b3d61b0b4d19fd75cffad0e1edc9
SHA-256: 02d5c25c03028e6588712df36cfae11a67ce0c1d82053793fbec018b55f04b81
openssh-askpass-6.6.1p1-23.el7_2.x86_64.rpm        MD5: 67d38d185180f37a555f9da72e350bd0
SHA-256: c08b486cb3457d13f67bdbac0b526b9d82225da2afb1b8e65658492a33e843b7
openssh-clients-6.6.1p1-23.el7_2.x86_64.rpm        MD5: 58efb3d2a957c648d614bd138c24feba
SHA-256: 7bf43948bf45a903398ba8bfb1959790138903047d21a0e7ed1b3a269ddcbf65
openssh-debuginfo-6.6.1p1-23.el7_2.i686.rpm        MD5: 4573e92cc76a0e44b347872db97f39d3
SHA-256: 0911be36881144e368b2b3e50933fcc024a7c708c9552327ac433b9e23438abb
openssh-debuginfo-6.6.1p1-23.el7_2.x86_64.rpm        MD5: 21e96ad2ca7a1445c29a5f55ddf173fc
SHA-256: 2495f2fbaf4f04e62e32ea1c2bcb3b1c084dafe9a50a9831844c9f1921546266
openssh-keycat-6.6.1p1-23.el7_2.x86_64.rpm        MD5: 03f8800c1e572738f8cddb583a5c2e69
SHA-256: 3ec6f587eec4ed7862ede492ed56b2c8253892e2a2c1441b7a0b473036e982db
openssh-ldap-6.6.1p1-23.el7_2.x86_64.rpm        MD5: bd612582cdba007dd6e1d1fa23f0ae86
SHA-256: afa29af34b161058475ef03f712eeaec73780ea781c217d6d5cb1362ce32851b
openssh-server-6.6.1p1-23.el7_2.x86_64.rpm        MD5: 657a6e2905519d719213faf61709b4d9
SHA-256: 057db9c007eed0a70b0ae77837d19566f2f36c83cdbbcd5a3545c30af99eca43
openssh-server-sysvinit-6.6.1p1-23.el7_2.x86_64.rpm        MD5: 187cc40d72ffd3045425aba0f0780974
SHA-256: f830fe2abf109d195545716e6844385ada6f240f0e04d54dbbe5df21fa8f8535
pam_ssh_agent_auth-0.9.3-9.23.el7_2.i686.rpm        MD5: b7138a12fe05f4a97da642067f43ca29
SHA-256: 96c195fff319a3058bd3590244a2a03a107afb3435ff77c01e46fff63cee1811
pam_ssh_agent_auth-0.9.3-9.23.el7_2.x86_64.rpm        MD5: 29dd7de78c7d393ad2ac33a5d9036f2e
SHA-256: 3e464afd2da795562905c918a0f9571c2b6721a3f3f03f2965dfcc840849d5ee

eva2000 · Jan 15, 2016

For CentOS 7

Code:

yum -q list updates
Updated Packages
openssh.x86_64          6.6.1p1-23.el7_2                                                                                                       updates
openssh-clients.x86_64         6.6.1p1-23.el7_2                                                                                                       updates
openssh-server.x86_64         6.6.1p1-23.el7_2                                                                                                       updates

After update command

Code:

yum -y update

Code:

 yum -q list installed openssh*
Installed Packages
openssh.x86_64         6.6.1p1-23.el7_2                                                                                                      @updates
openssh-clients.x86_64         6.6.1p1-23.el7_2                                                                                                      @updates
openssh-server.x86_64         6.6.1p1-23.el7_2                                                                                                      @updates

openssh changelog

Code:

rpm -qa --changelog openssh | head -n4
* Wed Jan 13 2016 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-23 + 0.9.3-9
- Disable undocumented feauture Roaming for good (#1298218)
- prevents CVE-2016-0777 and CVE-2016-0778

rdan · Jan 15, 2016

Just updated all my servers

yum clean all && yum -y update && logout
Click to expand...

Sunka · Jan 15, 2016

Done!

Code:

[root@tvor-ocean ~]# yum update
Loaded plugins: fastestmirror, priorities
base                                                     | 3.6 kB     00:00    
elasticsearch-2.x                                        | 2.9 kB     00:00    
epel/x86_64/metalink                                     |  28 kB     00:00    
epel                                                     | 4.3 kB     00:00    
extras                                                   | 3.4 kB     00:00    
mariadb                                                  | 2.9 kB     00:00    
rpmforge                                                 | 1.9 kB     00:00    
updates                                                  | 3.4 kB     00:00    
(1/3): epel/x86_64/updateinfo                              | 456 kB   00:00    
epel/x86_64/primary_db         FAILED                                         
http://mirror.23media.de/epel/7/x86_64/repodata/96e9b3b287efbf8ba1144761eff651fe3c74a5bc3b56e4cbc98f43944969e5de-primary.sqlite.xz: [Errno 14] HTTP Error 404 - Not Found
Trying other mirror.
To address this issue please refer to the below knowledge base article

https://access.redhat.com/articles/1320623

If above article doesn't help to resolve this issue please create a bug on https://bugs.centos.org/

(2/3): epel/x86_64/primary_db                              | 3.7 MB   00:00    
(3/3): updates/7/x86_64/primary_db                         | 1.7 MB   00:00    
Loading mirror speeds from cached hostfile
* base: ftp-stud.fht-esslingen.de
* epel: mirror.de.leaseweb.net
* extras: mirror.imt-systems.com
* rpmforge: mirror.de.leaseweb.net
* updates: mirror.de.leaseweb.net
230 packages excluded due to repository priority protections
Resolving Dependencies
--> Running transaction check
---> Package openssh.x86_64 0:6.6.1p1-22.el7 will be updated
---> Package openssh.x86_64 0:6.6.1p1-23.el7_2 will be an update
---> Package openssh-clients.x86_64 0:6.6.1p1-22.el7 will be updated
---> Package openssh-clients.x86_64 0:6.6.1p1-23.el7_2 will be an update
---> Package openssh-server.x86_64 0:6.6.1p1-22.el7 will be updated
---> Package openssh-server.x86_64 0:6.6.1p1-23.el7_2 will be an update
--> Finished Dependency Resolution

Dependencies Resolved

================================================================================
Package               Arch         Version                 Repository     Size
================================================================================
Updating:
openssh               x86_64       6.6.1p1-23.el7_2        updates       435 k
openssh-clients       x86_64       6.6.1p1-23.el7_2        updates       639 k
openssh-server        x86_64       6.6.1p1-23.el7_2        updates       436 k

Transaction Summary
================================================================================
Upgrade  3 Packages

Total download size: 1.5 M
Is this ok [y/d/N]: y
Downloading packages:
updates/7/x86_64/prestodelta                               | 129 kB   00:00    
(1/3): openssh-6.6.1p1-23.el7_2.x86_64.rpm                 | 435 kB   00:00    
(2/3): openssh-clients-6.6.1p1-23.el7_2.x86_64.rpm         | 639 kB   00:00    
(3/3): openssh-server-6.6.1p1-23.el7_2.x86_64.rpm          | 436 kB   00:00    
--------------------------------------------------------------------------------
Total                                              4.8 MB/s | 1.5 MB  00:00    
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Updating   : openssh-6.6.1p1-23.el7_2.x86_64                              1/6
  Updating   : openssh-server-6.6.1p1-23.el7_2.x86_64                       2/6
  Updating   : openssh-clients-6.6.1p1-23.el7_2.x86_64                      3/6
  Cleanup    : openssh-clients-6.6.1p1-22.el7.x86_64                        4/6
  Cleanup    : openssh-server-6.6.1p1-22.el7.x86_64                         5/6
  Cleanup    : openssh-6.6.1p1-22.el7.x86_64                                6/6
  Verifying  : openssh-server-6.6.1p1-23.el7_2.x86_64                       1/6
  Verifying  : openssh-clients-6.6.1p1-23.el7_2.x86_64                      2/6
  Verifying  : openssh-6.6.1p1-23.el7_2.x86_64                              3/6
  Verifying  : openssh-clients-6.6.1p1-22.el7.x86_64                        4/6
  Verifying  : openssh-6.6.1p1-22.el7.x86_64                                5/6
  Verifying  : openssh-server-6.6.1p1-22.el7.x86_64                         6/6

Updated:
  openssh.x86_64 0:6.6.1p1-23.el7_2                                            
  openssh-clients.x86_64 0:6.6.1p1-23.el7_2                                    
  openssh-server.x86_64 0:6.6.1p1-23.el7_2                                     

Complete!

eva2000 · Jan 15, 2016

FYI if folks had setup yum-cron to auto yum update nightly, you would of auto updated to openssh packages eventually as well Automatic nightly YUM updates with yum-cron | Centmin Mod Community

Jimmy · Jan 15, 2016

Might be a little off-topic but what's the current version of Centos 7 or 7.2? I can only seem to dload 7 from the site.

Sunka · Jan 15, 2016

7.2

Jimmy · Jan 15, 2016

Sunka said: ↑

7.2
Click to expand...

Thanks. Looks like I'm already running 7.2. I should have checked before posting.

Log in / Register

Forums

Join the community today

Security OpenSSH Security Bug CVE-2016-0777 & CVE-2016-0778

eva2000 Administrator Staff Member

Workaround

Other info links

Updated OpenSSH packages

negative Active Member

rdan Well-Known Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

Jimmy Well-Known Member

hardousse Active Member

rdan Well-Known Member

eva2000 Administrator Staff Member

Sunka Well-Known Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

rdan Well-Known Member

Sunka Well-Known Member

eva2000 Administrator Staff Member

Jimmy Well-Known Member

Sunka Well-Known Member

Jimmy Well-Known Member

.

Log in / Register

Useful Searches

Join the community today

Security OpenSSH Security Bug CVE-2016-0777 & CVE-2016-0778

eva2000 Administrator Staff Member

Workaround

Other info links

Updated OpenSSH packages

negative Active Member

rdan Well-Known Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

Jimmy Well-Known Member

hardousse Active Member

rdan Well-Known Member

eva2000 Administrator Staff Member

Sunka Well-Known Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

rdan Well-Known Member

Sunka Well-Known Member

eva2000 Administrator Staff Member

Jimmy Well-Known Member

Sunka Well-Known Member

Jimmy Well-Known Member

.