CVE-2015-5600
Published: 2 August 2015
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list.
Notes
| Author | Note |
|---|---|
| tyhicks | Only affects systems with KbdInteractiveAuthentication set to 'yes'. By default, that option is set to 'no' in Ubuntu. |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
openssh Launchpad, Ubuntu, Debian |
precise |
Released
(1:5.9p1-5ubuntu1.6)
|
| trusty |
Released
(1:6.6p1-2ubuntu2.2)
|
|
| upstream |
Needed
|
|
| vivid |
Released
(1:6.7p1-5ubuntu1.2)
|
|
|
Patches: upstream: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth2-chall.c.diff?r1=1.42&r2=1.43&f=h upstream: https://github.com/openssh/openssh-portable/commit/5b64f85bb811246c59ebab70aed331f26ba37b18 |
||