CVE-2016-10009

HIGH 7.3CVE-2016-10009 · Published 05/01/2017 · updated 17/06/2026

Package	Affected versions	Patched versions
openssh openbsd	`≤ 7.3`	No fix yet

Description

Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.

References

packetstormsecurity.com/files/140261/OpenSSH-Arbitrary-Library-Loading.html
packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html
seclists.org/fulldisclosure/2023/Jul/31
openwall.com/lists/oss-security/2016/12/19/2 · Mailing List
openwall.com/lists/oss-security/2023/07/19/9
openwall.com/lists/oss-security/2023/07/20/1
securityfocus.com/bid/94968
securitytracker.com/id/1037490
slackware.com/security/viewer.php
access.redhat.com/errata/RHSA-2017:2029
bugs.chromium.org/p/project-zero/issues/detail
cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
openbsd/src commit 9476ce1 · Patch
lists.debian.org/debian-lts-announce/2018/09/msg00010.html
security.freebsd.org/advisories/FreeBSD-SA-17:01.openssh.asc
security.netapp.com/advisory/ntap-20171130-0002
support.hpe.com/hpsc/doc/public/display
usn.ubuntu.com/3538-1
exploit-db.com/exploits/40963
openssh.com/txt/release-7.4

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free