CVE-2015-5352

The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time window.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 91%
Affected Products (NVD)
VendorProductVersion
openbsdopenssh
𝑥
≤ 6.8
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
openssh
bookworm
1:9.2p1-2+deb12u3
fixed
bookworm (security)
1:9.2p1-2+deb12u3
fixed
bullseye
1:8.4p1-5+deb11u3
fixed
bullseye (security)
1:8.4p1-5+deb11u3
fixed
sid
1:9.9p1-3
fixed
trixie
1:9.9p1-3
fixed
wheezy
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
openssh
precise
Fixed 1:5.9p1-5ubuntu1.6
released
trusty
Fixed 1:6.6p1-2ubuntu2.2
released
utopic
ignored
vivid
Fixed 1:6.7p1-5ubuntu1.2
released
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
openssh
RHEL 6
0:5.3p1-117.el6
fixed
openssh-askpass
RHEL 6
0:5.3p1-117.el6
fixed
openssh-clients
RHEL 6
0:5.3p1-117.el6
fixed
openssh-ldap
RHEL 6
0:5.3p1-117.el6
fixed
openssh-server
RHEL 6
0:5.3p1-117.el6
fixed
pam
RHEL 6
0:0.9.3-117.el6
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
openssh
Amazon Linux 1
0:6.2p2-8.44.amzn1
fixed
openssh-clients
Amazon Linux 1
0:6.2p2-8.44.amzn1
fixed
openssh-debuginfo
Amazon Linux 1
0:6.2p2-8.44.amzn1
fixed
openssh-keycat
Amazon Linux 1
0:6.2p2-8.44.amzn1
fixed
openssh-ldap
Amazon Linux 1
0:6.2p2-8.44.amzn1
fixed
openssh-server
Amazon Linux 1
0:6.2p2-8.44.amzn1
fixed
pam_ssh_agent_auth
Amazon Linux 1
0:0.9.3-5.8.44.amzn1
fixed
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html
http://openwall.com/lists/oss-security/2015/07/01/10
http://rhn.redhat.com/errata/RHSA-2016-0741.html
http://www.openssh.com/txt/release-6.9
http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
http://www.securityfocus.com/bid/75525
http://www.securitytracker.com/id/1032797
http://www.ubuntu.com/usn/USN-2710-1
http://www.ubuntu.com/usn/USN-2710-2
https://anongit.mindrot.org/openssh.git/commit/?h=V_6_9&id=1bf477d3cdf1a864646d59820878783d42357a1d
https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html
https://security.gentoo.org/glsa/201512-04
https://security.netapp.com/advisory/ntap-20181023-0001/
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html
http://openwall.com/lists/oss-security/2015/07/01/10
http://rhn.redhat.com/errata/RHSA-2016-0741.html
http://www.openssh.com/txt/release-6.9
http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
http://www.securityfocus.com/bid/75525
http://www.securitytracker.com/id/1032797
http://www.ubuntu.com/usn/USN-2710-1
http://www.ubuntu.com/usn/USN-2710-2
https://anongit.mindrot.org/openssh.git/commit/?h=V_6_9&id=1bf477d3cdf1a864646d59820878783d42357a1d
https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html
https://security.gentoo.org/glsa/201512-04
https://security.netapp.com/advisory/ntap-20181023-0001/