{"status":"success","advisory":{"_id":"683547225b16347a91c39cdd","kb_acknowledgements":null,"kb_affected_list":["AFF Baseboard Management Controller (BMC) - A700s","Cluster Network Switch (NetApp CN1610)","Clustered Data ONTAP","Data ONTAP operating in 7-Mode","NetApp Cloud Backup (formerly AltaVault)","NetApp SolidFire, Enterprise SDS & HCI Storage Node (Element Software)","NetApp SteelStore Cloud Integrated Storage","NetApp VASA Provider for Clustered Data ONTAP 9.7 and above","ONTAP Select Deploy administration utility","OnCommand Balance","OnCommand Unified Manager for Clustered Data ONTAP","Service Processor","StorageGRID (formerly StorageGRID Webscale)","StorageGRID9 (9.x and prior)"],"kb_bad_data":false,"kb_cve":["CVE-2016-6515: OpenSSH vulnerability"],"kb_exploitation":"Public","kb_fixes":[{"product":"NetApp SteelStore Cloud Integrated Storage","fixes":[],"instructions":null,"wontfix":true,"eos_link":"https://mysupport.netapp.com/info/communications/ECMLP2397079.html"},{"product":"StorageGRID (formerly StorageGRID Webscale)","fixes":[{"link":"https://mysupport.netapp.com/NOW/download/software/storagegrid_webscale/11.1/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"AFF Baseboard Management Controller (BMC) - A700s","fixes":[{"link":"https://mysupport.netapp.com/site/downloads/firmware/system-firmware-diagnostics","cves":[]}],"instructions":"The first fixed version is 1.81.\r\nTo download the patch, choose “Service Image” from the AFF_A700s “System Firmware + Diagnostics Download” page.","wontfix":false,"eos_link":null},{"product":"NetApp VASA Provider for Clustered Data ONTAP 9.7 and above","fixes":[{"link":"https://mysupport.netapp.com/NOW/download/software/vasa_cdot/7.0/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"Clustered Data ONTAP","fixes":[{"link":"https://mysupport.netapp.com/NOW/download/software/ontap/9.1/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"OnCommand Balance","fixes":[],"instructions":null,"wontfix":true,"eos_link":"https://mysupport.netapp.com/info/communications/ECMP1655122.html"},{"product":"OnCommand Unified Manager for Clustered Data ONTAP","fixes":[],"instructions":"7.0GA","wontfix":false,"eos_link":null},{"product":"Service Processor","fixes":[{"link":"https://mysupport.netapp.com/NOW/download/tools/serviceimage/support/","cves":[]}],"instructions":"Fixed by bug 1029897. \r\nFirst fixed versions include the following: \r\nSP_1.4.3/1.4.4, 2.2.4/2.2.5, 3.0.3/3.0.4, 1.5.2P1, 2.3.2P1, 3.1.2P2, 1.6.1, 2.4.1, 3.2.1, 4.0, 5.0","wontfix":false,"eos_link":null},{"product":"Cluster Network Switch (NetApp CN1610)","fixes":[{"link":"https://mysupport.netapp.com/NOW/download/software/sanswitch/fcp/NetApp/cn1610cm/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"Data ONTAP operating in 7-Mode","fixes":[{"link":"http://mysupport.netapp.com/NOW/download/software/ontap/8.2.5/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"NetApp SolidFire, Enterprise SDS & HCI Storage Node (Element Software)","fixes":[{"link":"https://mysupport.netapp.com/products/solidfire/11.0/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"ONTAP Select Deploy administration utility","fixes":[{"link":"https://mysupport.netapp.com/NOW/download/software/ontap_select/9.3.26/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"NetApp Cloud Backup (formerly AltaVault)","fixes":[],"instructions":null,"wontfix":true,"eos_link":"https://mysupport.netapp.com/info/communications/ECMLP2880179.html"}],"kb_impact":"Successful exploitation of this vulnerability can lead to a denial of service (DoS).","kb_internal_notes":[{"burt":"1261611","jira":"","product":"AFF Baseboard Management Controller (BMC) - A700s"},{"burt":"1028921","jira":"","product":"Cluster Network Switch (NetApp CN1610)"},{"burt":"1028923","jira":"","product":"Clustered Data ONTAP"},{"burt":"1028919","jira":"","product":"Data ONTAP operating in 7-Mode"},{"burt":"1155314","jira":"","product":"NetApp Cloud Backup (formerly AltaVault)"},{"burt":"","jira":"SECURITY-287","product":"NetApp SolidFire, Enterprise SDS & HCI Storage Node (Element Software)"},{"burt":"1155313","jira":"","product":"NetApp SteelStore Cloud Integrated Storage"},{"burt":"1028924","jira":"","product":"NetApp VASA Provider for Clustered Data ONTAP 9.7 and above"},{"burt":"1028922","jira":"","product":"ONTAP Select Deploy administration utility"},{"burt":"1028925","jira":"","product":"OnCommand Balance"},{"burt":"1028926","jira":"","product":"OnCommand Unified Manager Core Package"},{"burt":"1155315","jira":"","product":"OnCommand Unified Manager Core Package"},{"burt":"1028927","jira":"","product":"OnCommand Unified Manager for Clustered Data ONTAP"},{"burt":"1028928","jira":"","product":"Perfstat"},{"burt":"1028930","jira":"","product":"Service Processor"},{"burt":"1028932","jira":"","product":"StorageGRID (formerly StorageGRID Webscale)"},{"burt":"1028931","jira":"","product":"StorageGRID9 (9.x and prior)"}],"kb_investigating_list":[],"kb_num":"9010000","kb_ref":["https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-6515"],"kb_rev_history":[{"comment":"Initial Public Release","date":"20171130","version":"1.0"},{"comment":"Clustered Data ONTAP added to Software Versions and Fixes","date":"20171222","version":"2.0"},{"comment":"OnCommand Balance moved to Won't Fix status","date":"20180122","version":"3.0"},{"comment":"Service Processor added to Software Versions and Fixes","date":"20180402","version":"4.0"},{"comment":"NetApp SteelStore Cloud Integrated Storage moved to Affected Products","date":"20180420","version":"5.0"},{"comment":"NetApp VASA Provider for Clustered Data ONTAP 7.0 and above added to Software Versions and Fixes","date":"20180423","version":"6.0"},{"comment":"ONTAP Select Deploy administration utility added to Software Versions and Fixes","date":"20180712","version":"7.0"},{"comment":"StorageGRID Webscale added to Software Versions and Fixes","date":"20180725","version":"8.0"},{"comment":"Cluster Network Switch (NetApp CN1610) added to Software Versions and Fixes","date":"20180823","version":"9.0"},{"comment":"NetApp Cloud Backup (formerly AltaVault) moved to Affected Products","date":"20181016","version":"10.0"},{"comment":"Element Software (formerly SolidFire Element OS) added to Software Versions and Fixes","date":"20181211","version":"11.0"},{"comment":"AFF Baseboard Management Controller (BMC) moved to Affected Products","date":"20190830","version":"12.0"},{"comment":"NetApp SteelStore Cloud Integrated Storage moved to Won't Fix status","date":"20200901","version":"13.0"},{"comment":"AFF Baseboard Management Controller (BMC) - A700s added to Software Versions and Fixes","date":"20201119","version":"14.0"},{"comment":"NetApp Cloud Backup (formerly AltaVault) moved to Won't Fix status, Final status","date":"20220106","version":"15.0"}],"kb_revised_list":[],"kb_scoring":{"CVE-2016-6515":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"kb_scoring_calc":[{"cve_id":"CVE-2016-6515","range":"HIGH","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"kb_status":"Final","kb_summary":"Multiple NetApp products incorporate the OpenSSH software libraries. OpenSSH versions below 7.3 are susceptible to a vulnerability that may be exploited to allows remote attackers to cause a denial of service (DoS). This advisory will be updated as additional information becomes available.","kb_title":"CVE-2016-6515 OpenSSH Vulnerability in NetApp Products","kb_unaffected_list":["7-Mode Transition Tool","ATTO FibreBridge - 6500N","Brocade Fabric Operating System Firmware","Cloud Manager","Clustered Data ONTAP Antivirus Connector","E-Series SANtricity Storage Manager","E-Series SANtricity Web Services (REST API) for Web Services Proxy","FAS/AFF BIOS","Host Utilities - SAN for Linux","Host Utilities - SAN for Windows","MetroCluster Tiebreaker for clustered Data ONTAP","NetApp Cloud Backup OST Plug-in (formerly AltaVault OST Plug-in)","NetApp Manageability SDK","NetApp NFS Plug-in for VMware VAAI","NetApp SANtricity SMI-S Provider","NetApp SMI-S Provider","NetApp Storage Encryption","OnCommand Insight","OnCommand Unified Manager Core Package","OnCommand Workflow Automation","Open Systems SnapVault Agent","Perfstat","Single Mailbox Recovery","Snap Creator Framework","SnapCenter","SnapDrive for Unix","SnapManager for Hyper-V","SnapManager for Oracle","SnapManager for SAP","Storage Services Connector","System Manager 9.x"],"kb_workarounds":"None at this time.","ntap_advisory_id":"NTAP-20171130-0003","adv_id":"ntap-20171130-0003","published_date":"2017-11-30T00:00:00","updated_date":"2022-01-06T00:00:00","inserted_date":"2025-05-27T05:01:22.081000","modified_date":null}}