CVE-2016-1908

Advisory lineage Upstream: 0 Downstream: 10
Modified
Published: 11 Apr 2017, 00:00
Last modified:29 May 2026, 20:14

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (nvd)
EPSS Score
2.37% LOW
2% probability -0.07%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

11 Apr 2017, 00:00
Published
Vulnerability first disclosed
29 May 2026, 20:14
Last Modified
Vulnerability information updated

Description

The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 2.37%• Percentile: 85%

Techniques & Countermeasures

  • CWE-287•Improper Authentication

    When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Systems

  • debian•debian_linux

    8.0

  • openbsd•openssh

    < 7.2

  • oracle•linux

    6 | 7

  • redhat•enterprise_linux_desktop

    6.0 | 7.0

  • redhat•enterprise_linux_eus

    7.2 | 7.3 | 7.4 | 7.5 | 7.6 | 7.7

  • redhat•enterprise_linux_server

    6.0 | 7.0

  • redhat•enterprise_linux_server_aus

    7.2 | 7.3 | 7.4 | 7.6 | 7.7

  • redhat•enterprise_linux_server_tus

    7.2 | 7.3 | 7.6 | 7.7

  • redhat•enterprise_linux_workstation

    6.0 | 7.0

References (12)