RHSA-2016:0043Medium

Red Hat Security Advisory: openssh security update

Published
January 14, 2016
Last Modified
November 5, 2026

🔗 CVE IDs covered (2)

CVE-2016-0777 →CVE-2016-0778 →

📋 Description

CVE-2016-0777 — OpenSSH: Client Information leak due to use of roaming connection feature CVE-2016-0778 — OpenSSH: Client buffer-overflow when using roaming connections

🎯 Affected products94

  • Red Hat Enterprise Linux Client (v. 7)
  • Red Hat Enterprise Linux Client Optional (v. 7)
  • Red Hat Enterprise Linux ComputeNode (v. 7)
  • Red Hat Enterprise Linux ComputeNode Optional (v. 7)
  • Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Enterprise Linux Server Optional (v. 7)
  • Red Hat Enterprise Linux Workstation (v. 7)
  • Red Hat Enterprise Linux Workstation Optional (v. 7)
  • openssh-0:6.6.1p1-23.el7_2.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)
  • openssh-0:6.6.1p1-23.el7_2.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)
  • openssh-0:6.6.1p1-23.el7_2.s390x as a component of Red Hat Enterprise Linux Server (v. 7)
  • openssh-0:6.6.1p1-23.el7_2.src as a component of Red Hat Enterprise Linux Client (v. 7)
  • openssh-0:6.6.1p1-23.el7_2.src as a component of Red Hat Enterprise Linux ComputeNode (v. 7)
  • openssh-0:6.6.1p1-23.el7_2.src as a component of Red Hat Enterprise Linux Server (v. 7)
  • openssh-0:6.6.1p1-23.el7_2.src as a component of Red Hat Enterprise Linux Workstation (v. 7)
  • openssh-0:6.6.1p1-23.el7_2.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)
  • openssh-0:6.6.1p1-23.el7_2.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)
  • openssh-0:6.6.1p1-23.el7_2.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)
  • openssh-0:6.6.1p1-23.el7_2.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)
  • openssh-askpass-0:6.6.1p1-23.el7_2.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)
  • openssh-askpass-0:6.6.1p1-23.el7_2.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)
  • openssh-askpass-0:6.6.1p1-23.el7_2.s390x as a component of Red Hat Enterprise Linux Server (v. 7)
  • openssh-askpass-0:6.6.1p1-23.el7_2.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)
  • openssh-askpass-0:6.6.1p1-23.el7_2.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)
  • openssh-askpass-0:6.6.1p1-23.el7_2.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)
  • openssh-askpass-0:6.6.1p1-23.el7_2.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)
  • openssh-clients-0:6.6.1p1-23.el7_2.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)
  • openssh-clients-0:6.6.1p1-23.el7_2.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)
  • openssh-clients-0:6.6.1p1-23.el7_2.s390x as a component of Red Hat Enterprise Linux Server (v. 7)
  • openssh-clients-0:6.6.1p1-23.el7_2.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)
  • +64 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: 1. The vulnerable roaming code can be permanently disabled by adding the undocumented option "UseRoaming no" to the system-wide configuration file (usually /etc/ssh/ssh_config), or per-user configuration file (~/.ssh/config), or command-line (-o "UseRoaming no"). 2. If an OpenSSH client is disconnected from an SSH server that offers roaming, it prints "[connection suspended, press return to resume]" on stderr, and waits for '\n' or '\r' on stdin (and not on the controlling terminal) before it reconnects to the server; advanced users may become suspicious and press Control-C or Control-Z instead, thus avoiding the information leak. However, SSH commands that use the local stdin to transfer data to the remote server are bound to trigger this reconnection automatically (upon reading a '\n' or '\r' from stdin). Moreover, these non-interactive SSH commands (for example, backup scripts and cron jobs) commonly employ public-key authentication and are therefore perfect targets for this information leak.

🔗 References (6)