SB2015073006 - Permissions, Privileges, and Access Controls in openssh (Alpine package)

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2015073006

SB2015073006 - Permissions, Privileges, and Access Controls in openssh (Alpine package)

Published: July 30, 2015

Security Bulletin ID SB2015073006
Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2015-5600)

The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.

The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list.


Remediation

Install update from vendor's website.

References