The remote AIX host has a version of OpenSSH installed that is affected by the following vulnerabilities :

  - An information disclosure vulnerability exists in the     resend_bytes() function in the undocumented roaming     connection feature. An authenticated, remote attacker     can exploit this vulnerability, by persuading a victim     to connect to a malicious server, to retrieve private     cryptographic keys or other sensitive information.
    (CVE-2016-0777)

  - A heap-based buffer overflow condition exists in the     undocumented roaming connection feature due to improper     bounds checking of user-supplied input to the     packet_write_wait() and ssh_packet_write_wait()     functions whenever the non-default option ProxyCommand     is used with either ForwardAgent or ForwardX11. An     authenticated, remote attacker can exploit this     vulnerability, by persuading a victim to connect to a     malicious server, to execute arbitrary code or cause     a denial of service. (CVE-2016-0778)

Sync with latest openssh package.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.06, has openssh packages installed that are affected by multiple vulnerabilities:

  - The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and     relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a     fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11     server, as demonstrated by lack of the SECURITY extension on this X11 server. (CVE-2016-1908)

  - Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service     (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecified vectors     that lead to a double-free. (CVE-2006-5051)

  - scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell     metacharacters or spaces, which are expanded twice. (CVE-2006-0225)

  - sshd in OpenSSH before 4.4, when using the version 1 SSH protocol, allows remote attackers to cause a     denial of service (CPU consumption) via an SSH packet that contains duplicate blocks, which is not     properly handled by the CRC compensation attack detector. (CVE-2006-4924)

  - Unspecified vulnerability in the sshd Privilege Separation Monitor in OpenSSH before 4.5 causes weaker     verification that authentication has been successful, which might allow attackers to bypass     authentication. NOTE: as of 20061108, it is believed that this issue is only exploitable by leveraging     vulnerabilities in the unprivileged process, which are not known to exist. (CVE-2006-5794)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06 (SP), has openssh packages installed that are affected by multiple vulnerabilities:

  - The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and     relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a     fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11     server, as demonstrated by lack of the SECURITY extension on this X11 server. (CVE-2016-1908)

  - Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service     (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecified vectors     that lead to a double-free. (CVE-2006-5051)

  - scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell     metacharacters or spaces, which are expanded twice. (CVE-2006-0225)

  - sshd in OpenSSH before 4.4, when using the version 1 SSH protocol, allows remote attackers to cause a     denial of service (CPU consumption) via an SSH packet that contains duplicate blocks, which is not     properly handled by the CRC compensation attack detector. (CVE-2006-4924)

  - Unspecified vulnerability in the sshd Privilege Separation Monitor in OpenSSH before 4.5 causes weaker     verification that authentication has been successful, which might allow attackers to bypass     authentication. NOTE: as of 20061108, it is believed that this issue is only exploitable by leveraging     vulnerabilities in the unprivileged process, which are not known to exist. (CVE-2006-5794)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

New openssh packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

Updated openssh packages that fix two security issues are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

OpenSSH is OpenBSD's SSH (Secure Shell) protocol implementation. These packages include the core files necessary for both the OpenSSH client and server.

An information leak flaw was found in the way the OpenSSH client roaming feature was implemented. A malicious server could potentially use this flaw to leak portions of memory (possibly including private SSH keys) of a successfully authenticated OpenSSH client.
(CVE-2016-0777)

A buffer overflow flaw was found in the way the OpenSSH client roaming feature was implemented. A malicious server could potentially use this flaw to execute arbitrary code on a successfully authenticated OpenSSH client if that client used certain non-default configuration options.
(CVE-2016-0778)

Red Hat would like to thank Qualys for reporting these issues.

All openssh users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

An information leak flaw was found in the way the OpenSSH client roaming feature was implemented. A malicious server could potentially use this flaw to leak portions of memory (possibly including private SSH keys) of a successfully authenticated OpenSSH client.
(CVE-2016-0777)

A buffer overflow flaw was found in the way the OpenSSH client roaming feature was implemented. A malicious server could potentially use this flaw to execute arbitrary code on a successfully authenticated OpenSSH client if that client used certain non-default configuration options.
(CVE-2016-0778)

After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

This update for openssh fixes the following issues :

  - CVE-2016-0777: A malicious or compromised server could     cause the OpenSSH client to expose part or all of the     client's private key through the roaming feature     (bsc#961642)

  - CVE-2016-0778: A malicious or compromised server could     could trigger a buffer overflow in the OpenSSH client     through the roaming feature (bsc#961645)

This update disables the undocumented feature supported by the OpenSSH client and a commercial SSH server.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201601-01 (OpenSSH: Multiple vulnerabilities)

    Qualys have reported two issues in the &ldquo;roaming&rdquo; code included in       the OpenSSH client, which provides undocumented, experimental support for       resuming SSH connections. An OpenSSH client could be tricked into leaking       parts of its memory to a malicious server. Furthermore, a buffer overflow       can be exploited by a malicious server, but its exploitation requires       non-default options and is mitigated due to another bug.
  Impact :

    A remote attacker could entice a user to connect to a specially crafted       OpenSSH server, possibly resulting in the disclosure of the user&rsquo;s       private keys. Users with private keys that are not protected by a       passphrase are advised to generate new keys if they have connected to an       SSH server they don&rsquo;t fully trust.
    Note that no special configuration is required to be vulnerable as the       roaming feature is enabled by default on the client.
  Workaround :

    The issues can be worked around by disabling the roaming code. To do so,       add &ldquo;UseRoaming no&rdquo; to the SSH client configuration, or specify &ldquo;-o       &lsquo;UseRoaming no&rsquo;&rdquo; on the command line.

According to its banner, the version of OpenSSH running on the remote host is 5.x prior to 5.4, 6.x or 7.x prior to 7.1p2. It is, therefore, affected by multiple vulnerabilities. 

  - A potential information disclosure vulnerability which     may allow remote servers to obtain sensitive information     from process memory by requesting transmission of an     entire buffer (CVE-2016-0777)

  - A denial of service vulnerability due to a heap-base     overflow in roaming_common.c (CVE-2016-0778)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2869-1 advisory.

    It was discovered that the OpenSSH client experimental support for resuming connections contained multiple     security issues. A malicious server could use this issue to leak client memory to the server, including     private client user keys.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for openssh fixes the following issues :

  - CVE-2016-0777: A malicious or compromised server could     cause the OpenSSH client to expose part or all of the     client's private key through the roaming feature     (bsc#961642)

  - CVE-2016-0778: A malicious or compromised server could     could trigger a buffer overflow in the OpenSSH client     through the roaming feature (bsc#961645)

This update disables the undocumented feature supported by the OpenSSH client and a commercial SSH server.

This update was imported from the SUSE:SLE-12:Update update project.

- CVE-2016-0777: A malicious or compromised server could     cause the OpenSSH client to expose part or all of the     client's private key through the roaming feature     (bsc#961642)

  - CVE-2016-0778: A malicious or compromised server could     could trigger a buffer overflow in the OpenSSH client     through the roaming feature (bsc#961645)

This update disables the undocumented feature supported by the OpenSSH client and a commercial SSH server.

Security fix for CVE-2016-0777 ---- This update provides several fixes for legacy ssh-copy-id, rpm macros and sshd-keygen

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
88590	AIX OpenSSH Advisory : openssh_advisory7.asc	Nessus	AIX Local Security Checks	2016/2/5	2023/4/21	medium
89505	Fedora 22 : gsi-openssh-6.9p1-7.fc22 (2016-2e89eba0c1)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	high
266250	NewStart CGSL MAIN 6.06 : openssh Multiple Vulnerabilities (NS-SA-2025-0210)	Nessus	NewStart CGSL Local Security Checks	2025/9/30	2025/9/30	critical
301236	NewStart CGSL MAIN 6.06 (SP) : openssh Multiple Vulnerabilities (NS-SA-2026-0003)	Nessus	NewStart CGSL Local Security Checks	2026/3/6	2026/3/6	critical
87929	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : openssh (SSA:2016-014-01)	Nessus	Slackware Local Security Checks	2016/1/15	2021/1/14	high
87930	CentOS 7 : openssh (CESA-2016:0043)	Nessus	CentOS Local Security Checks	2016/1/15	2025/2/18	critical
87937	RHEL 7 : openssh (RHSA-2016:0043)	Nessus	Red Hat Local Security Checks	2016/1/15	2019/10/24	high
87938	Scientific Linux Security Update : openssh on SL7.x x86_64 (20160114)	Nessus	Scientific Linux Local Security Checks	2016/1/15	2021/1/14	high
87962	SUSE SLED11 / SLES11 Security Update : openssh (SUSE-SU-2016:0119-1)	Nessus	SuSE Local Security Checks	2016/1/18	2021/1/6	high
87963	SUSE SLED11 / SLES11 Security Update : openssh (SUSE-SU-2016:0120-1)	Nessus	SuSE Local Security Checks	2016/1/18	2021/1/6	high
87985	GLSA-201601-01 : OpenSSH: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2016/1/19	2021/1/11	high
106608	OpenSSH 5.4 < 7.1p2 Multiple Vulnerabilities	Nessus	Misc.	2018/2/5	2025/10/30	high
87939	Ubuntu 14.04 LTS : OpenSSH vulnerabilities (USN-2869-1)	Nessus	Ubuntu Local Security Checks	2016/1/15	2025/2/18	critical
88128	openSUSE Security Update : openssh (openSUSE-2016-38)	Nessus	SuSE Local Security Checks	2016/1/25	2021/1/19	high
88157	openSUSE Security Update : openssh (openSUSE-2016-49)	Nessus	SuSE Local Security Checks	2016/1/26	2021/1/19	high
89559	Fedora 23 : openssh-7.1p2-1.fc23 (2016-67c6ef0d4f)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	medium

检测

插件搜索

medium

high

critical

critical

high

critical

high

high

high

high

high

high

critical

high

high

medium