CVE-2016-10708
High
Description
sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Openbsd Openssh
PublishedJan 21, 2018
First seenJan 21, 2018
Weakness typeCWE-476NULL pointer dereference
How to fix
Update
- openbsd openssh7.4 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openbsd openssh | v < 7.4 | 7.4 |
| debian debian_linux | 7.0, 8.0 | — |
| canonical ubuntu_linux | 14.04, 16.04, 18.04 | — |
| netapp cloud_backup | No range specified | — |
| netapp data_ontap | No range specified | — |
| netapp data_ontap_edge | No range specified | — |
| netapp oncommand_unified_manager | 9.4 ≤ v | — |
| netapp service_processor | No range specified | — |
| netapp storagegrid | No range specified | — |
| netapp storagegrid_webscale | No range specified | — |
| netapp clustered_data_ontap | No range specified | — |
| netapp vasa_provider | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.