CVE-2015-5352: The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which… | LiveThreat CVE Feed — Verisq

Login Request a demo

Unscored severity · published Aug 3, 2015

CVE-2015-5352

The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which…

–

CVSS

4.5%

EPSS

No

On KEV

Description

The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time window.

Exploitation

Is it being used?

Exploit prediction (EPSS)4.5% · higher than 91% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

OP

Openssh · Openbsd

through 6.8 · source: NVD

Affected product

OP

Openssh

Openbsd

All Openssh CVEs

References

https://nvd.nist.gov/vuln/detail/CVE-2015-5352

https://www.cve.org/CVERecord?id=CVE-2015-5352

lists.opensuse.org

http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html

http://openwall.com/lists/oss-security/2015/07/01/10

http://rhn.redhat.com/errata/RHSA-2016-0741.html

Vendor Advisory

http://www.openssh.com/txt/release-6.9

http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

More from Openssh

9.8

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an…

9.8

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints

9.8

The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows…

9.8

OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for…

9.8

Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication)…