Vulnerability-Lookup

BDU:2017-00350 (CVE-2016-10012)

Vulnerability from fstec – Published: 2017-02-17 – Updated: 2024-11-28 – View on bdu.fstec.ru Fixed

Title

Уязвимость менеджера разделяемой памяти демона sshd средства криптографической защиты OpenSSH, позволяющая нарушителю повысить свои привилегии

Summary

Уязвимость менеджера разделяемой памяти демона sshd средства криптографической защиты OpenSSH вызвана выходом операции за границы буфера в памяти. Эксплуатация уязвимости может позволить нарушителю, действующему локально, повысить свои привилегии с использованием доступа к изолированному процессу разделения привилегий, связанному со структурами данных m_zback и m_zlib

Severity

7.2 (High) CVSS 2.0


                      
                        AV:L/AC:L/Au:N/C:C/I:C/A:C

7.8 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Data structure manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-119 - Выход операции за границы буфера в памяти

Aliases

CVE-2016-10012, SECURITY, TRACKER, ID:1037490, BID, ID:94975

References

8 references

URL
http://www.openwall.com/lists/oss-security/2016/12/19/2
http://www.securityfocus.com/bid/94975
http://www.securitytracker.com/id/1037490
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slac…
https://github.com/openbsd/src/commit/3095060f479b86288e31c79ecbc5131a66bcd2f9
https://www.openssh.com/txt/release-7.4
https://www.moxa.com/en/support/product-support/security-advisory/edr-810-serie…
https://security.paloaltonetworks.com/PAN-SA-2020-0005

Impacted products

4 products from 4 vendors

Vendors

The OpenBSD Project, Moxa Inc., Juniper Networks Inc., Palo Alto Networks Inc.

Products

OpenSSH, MOXA EDR-810, JunOS, PAN-OS

Versions

до версии 7.4 (OpenSSH), 4.1 (MOXA EDR-810), 17.2 (JunOS), 17.3 (JunOS), 17.4 (JunOS), 18.1 (JunOS), 18.2 (JunOS), до 9.0.1 (PAN-OS), 18.3 (JunOS), 18.4 (JunOS), 19.1 (JunOS), от 7.1.0 до 7.1.26 (PAN-OS), от 8.1.0 до 8.1.13 (PAN-OS)

Product types

Security software, Network appliance software, Operating system

Platforms

Сообщество свободного программного обеспечения Linux . 64-bit, Сообщество свободного программного обеспечения Linux . 32-bit, Apple Inc. MacOS 10 32-bit, Apple Inc. MacOS 10 64-bit, Oracle Corp. Solaris . 64-bit, Oracle Corp. Solaris . 32-bit, IBM Corp. AIX . 32-bit, IBM Corp. AIX . 64-bit, HP Inc. HP-UX . 32-bit, HP Inc. HP-UX . 64-bit, FreeBSD Project FreeBSD . 64-bit, FreeBSD Project FreeBSD . 32-bit, The NetBSD Project NetBSD . 32-bit, The OpenBSD Project OpenBSD . 64-bit, The OpenBSD Project OpenBSD . 32-bit, Computer Science Research Group NetBSD . 64-bit, SCO Group SCO . 64-bit, SCO Group SCO . 32-bit, Silicon Graphics Corp. IRIX . 64-bit, Silicon Graphics Corp. IRIX . 32-bit, Juniper Networks Inc. JunOS 17.2, Juniper Networks Inc. JunOS 17.3, Juniper Networks Inc. JunOS 17.4, Juniper Networks Inc. JunOS 18.1, Juniper Networks Inc. JunOS 18.2, Palo Alto Networks Inc. PAN-OS до 9.0.1, Juniper Networks Inc. JunOS 18.3, Juniper Networks Inc. JunOS 18.4, Juniper Networks Inc. JunOS 19.1, Palo Alto Networks Inc. PAN-OS от 7.1.0 до 7.1.26, Palo Alto Networks Inc. PAN-OS от 8.1.0 до 8.1.13

Mitigations

Использование рекомендаций: Для MOXA: https://www.moxa.com/en/support/product-support/security-advisory/edr-810-series-security-router-vulnerabilities-(1) Для OpenSSH: https://github.com/openbsd/src/commit/3095060f479b86288e31c79ecbc5131a66bcd2f9 Для PAN-OS: https://security.paloaltonetworks.com/PAN-SA-2020-0005

Credits

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "The OpenBSD Project, Moxa Inc., Juniper Networks Inc., Palo Alto Networks Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.4 (OpenSSH), 4.1 (MOXA EDR-810), 17.2 (JunOS), 17.3 (JunOS), 17.4 (JunOS), 18.1 (JunOS), 18.2 (JunOS), \u0434\u043e 9.0.1 (PAN-OS), 18.3 (JunOS), 18.4 (JunOS), 19.1 (JunOS), \u043e\u0442 7.1.0 \u0434\u043e 7.1.26 (PAN-OS), \u043e\u0442 8.1.0 \u0434\u043e 8.1.13 (PAN-OS)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f MOXA:\nhttps://www.moxa.com/en/support/product-support/security-advisory/edr-810-series-security-router-vulnerabilities-(1)\n\n\u0414\u043b\u044f OpenSSH:\n\nhttps://github.com/openbsd/src/commit/3095060f479b86288e31c79ecbc5131a66bcd2f9\n\n\u0414\u043b\u044f PAN-OS:\nhttps://security.paloaltonetworks.com/PAN-SA-2020-0005",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "05.01.2017",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "28.11.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "17.02.2017",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2017-00350",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2016-10012, Security Tracker ID:1037490, BID ID:94975",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "OpenSSH, MOXA EDR-810, JunOS, PAN-OS",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "\u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux . 64-bit, \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux . 32-bit, Apple Inc. MacOS 10 32-bit, Apple Inc. MacOS 10 64-bit, Oracle Corp. Solaris . 64-bit, Oracle Corp. Solaris . 32-bit, IBM Corp. AIX . 32-bit, IBM Corp. AIX . 64-bit, HP Inc. HP-UX . 32-bit, HP Inc. HP-UX . 64-bit, FreeBSD Project FreeBSD . 64-bit, FreeBSD Project FreeBSD . 32-bit, The NetBSD Project NetBSD . 32-bit, The OpenBSD Project OpenBSD . 64-bit, The OpenBSD Project OpenBSD . 32-bit, Computer Science Research Group NetBSD . 64-bit, SCO Group SCO . 64-bit, SCO Group SCO . 32-bit, Silicon Graphics Corp. IRIX . 64-bit, Silicon Graphics Corp. IRIX . 32-bit, Juniper Networks Inc. JunOS 17.2 , Juniper Networks Inc. JunOS 17.3 , Juniper Networks Inc. JunOS 17.4 , Juniper Networks Inc. JunOS 18.1 , Juniper Networks Inc. JunOS 18.2 , Palo Alto Networks Inc. PAN-OS \u0434\u043e 9.0.1 , Juniper Networks Inc. JunOS 18.3 , Juniper Networks Inc. JunOS 18.4 , Juniper Networks Inc. JunOS 19.1 , Palo Alto Networks Inc. PAN-OS \u043e\u0442 7.1.0 \u0434\u043e 7.1.26 , Palo Alto Networks Inc. PAN-OS \u043e\u0442 8.1.0 \u0434\u043e 8.1.13 ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430 \u0440\u0430\u0437\u0434\u0435\u043b\u044f\u0435\u043c\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u0435\u043c\u043e\u043d\u0430 sshd \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0412\u044b\u0445\u043e\u0434 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u044b \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 (CWE-119)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430 \u0440\u0430\u0437\u0434\u0435\u043b\u044f\u0435\u043c\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u0435\u043c\u043e\u043d\u0430 sshd \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b OpenSSH \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0432\u044b\u0445\u043e\u0434\u043e\u043c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u044b \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e, \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0443 \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0441\u043e \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 m_zback \u0438 m_zlib",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": "-",
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "http://www.openwall.com/lists/oss-security/2016/12/19/2\nhttp://www.securityfocus.com/bid/94975\nhttp://www.securitytracker.com/id/1037490\nhttp://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2016\u0026m=slackware-security.647637\nhttps://github.com/openbsd/src/commit/3095060f479b86288e31c79ecbc5131a66bcd2f9\nhttps://www.openssh.com/txt/release-7.4\nhttps://www.moxa.com/en/support/product-support/security-advisory/edr-810-series-security-router-vulnerabilities-(1)\nhttps://security.paloaltonetworks.com/PAN-SA-2020-0005",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u041f\u041e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430, \u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-119",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,2)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)"
}

CVE-2016-10012 (GCVE-0-2016-10012)

Vulnerability from cvelistv5 – Published: 2017-01-05 00:00 – Updated: 2026-05-29 20:48

Summary

The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and m_zlib data structures.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-01-30 19:00 UTC

CWE

n/a
CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mitre mitre root

References

12 references

URL	Tags
https://security.netapp.com/advisory/ntap-2017113…
http://www.openwall.com/lists/oss-security/2016/12/19/2	mailing-list
http://www.securitytracker.com/id/1037490	vdb-entry
https://support.hpe.com/hpsc/doc/public/display?d…
http://www.slackware.com/security/viewer.php?l=sl…
https://access.redhat.com/errata/RHSA-2017:2029	vendor-advisory
https://lists.debian.org/debian-lts-announce/2018…	mailing-list
https://www.openssh.com/txt/release-7.4
http://www.securityfocus.com/bid/94975	vdb-entry
https://github.com/openbsd/src/commit/3095060f479…
https://support.f5.com/csp/article/K62201745?utm_…
https://cert-portal.siemens.com/productcert/pdf/s…

Date Public

2016-12-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T03:07:31.930Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20171130-0002/"
          },
          {
            "name": "[oss-security] 20161219 Announce: OpenSSH 7.4 released",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/12/19/2"
          },
          {
            "name": "1037490",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037490"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03818en_us"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2016\u0026m=slackware-security.647637"
          },
          {
            "name": "RHSA-2017:2029",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2029"
          },
          {
            "name": "[debian-lts-announce] 20180910 [SECURITY] [DLA 1500-1] openssh security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openssh.com/txt/release-7.4"
          },
          {
            "name": "94975",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94975"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/openbsd/src/commit/3095060f479b86288e31c79ecbc5131a66bcd2f9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.f5.com/csp/article/K62201745?utm_source=f5support\u0026amp%3Butm_medium=RSS"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2016-10012",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-30T19:00:16.210612Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-29T20:48:17.999Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-12-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and m_zlib data structures."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-13T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://security.netapp.com/advisory/ntap-20171130-0002/"
        },
        {
          "name": "[oss-security] 20161219 Announce: OpenSSH 7.4 released",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/12/19/2"
        },
        {
          "name": "1037490",
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securitytracker.com/id/1037490"
        },
        {
          "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03818en_us"
        },
        {
          "url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2016\u0026m=slackware-security.647637"
        },
        {
          "name": "RHSA-2017:2029",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2029"
        },
        {
          "name": "[debian-lts-announce] 20180910 [SECURITY] [DLA 1500-1] openssh security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html"
        },
        {
          "url": "https://www.openssh.com/txt/release-7.4"
        },
        {
          "name": "94975",
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securityfocus.com/bid/94975"
        },
        {
          "url": "https://github.com/openbsd/src/commit/3095060f479b86288e31c79ecbc5131a66bcd2f9"
        },
        {
          "url": "https://support.f5.com/csp/article/K62201745?utm_source=f5support\u0026amp%3Butm_medium=RSS"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-10012",
    "datePublished": "2017-01-05T00:00:00.000Z",
    "dateReserved": "2016-12-19T00:00:00.000Z",
    "dateUpdated": "2026-05-29T20:48:17.999Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.