Multiple CRLF injection vulnerabilities in session.c in OpenSSH before 7.2p2

Posted by vando on Wednesday March 23, 2016 @01:43PM
from the web.nvd.nist.gov dept.

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3115

( 2 comments | 19 points | on HN )

Re:Multiple CRLF injection vulnerabilities in session.c in O... by cat-dev-null on Wednesday March 23, 2016 @02:48PM (#11347148)

Not a huge deal since X11Forwarding is usually disabled by default.

It is another reason for best practices of just-enough infrastructure -> smaller attack surface: disable unused features and ship server daemons with sane defaults with minimal features enabled.

[ Parent | on HN ]

Re:Multiple CRLF injection vulnerabilities in session.c in O... by anjbe on Wednesday March 23, 2016 @03:33PM (#11347507)

> Not a huge deal since X11Forwarding is usually disabled by default.

Except on Red Hat… https://threatpost.com/openssh-implementations-with-x11forwa...

[ Parent | on HN ]