#VU2075 Buffer overflow in OpenSSH - CVE-2016-10012

Vulnerability identifier: #VU2075

Vulnerability risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-10012

CWE-ID: CWE-119

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
OpenSSH
Server applications / Remote management servers, RDP, SSH

Vendor: OpenSSH

Description
The vulnerability allows a local user to execute arbitrary code on vulnerable system with root privileges.

The vulnerability exists in sshd due to a flaw in boundary checks in the shared memory manager that may be skipped by some optimizing compilers. A local user can trigger memory corruption and execute arbitrary code with root privileges. The issue is related to m_zback and m_zlib data structures.

Successful exploitation of this vulnerability may allow a local user to elevate privileges.

Mitigation
Install the latest version of OpenSSH 7.4.

Vulnerable software versions

OpenSSH: 7.3p1

---

External links
https://www.openssh.com/txt/release-7.4
https://github.com/openbsd/src/commit/3095060f479b86288e31c79ecbc5131a66bcd2f9
https://www.openwall.com/lists/oss-security/2016/12/19/2

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.