(OpenBSD Issues Fix) OpenSSH Race Condition in Signal Handler Lets Remote Users Deny Service and May Potentially Permit Code Execution
|
|
SecurityTracker Alert ID: 1017053 |
|
SecurityTracker URL: http://securitytracker.com/id/1017053
|
|
CVE Reference:
CVE-2006-5051
(Links to External Site)
|
Date: Oct 12 2006
|
Impact:
Denial of service via network, Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 4.3 and prior versions
|
Description:
A vulnerability was reported in OpenSSH. A remote user can cause denial of service conditions. A remote user may be able to execute arbitrary code on the target system.
A remote user can exploit a race condition in an unsafe signal hander to cause denial of service conditions.
On portable OpenSSH, a remote user may theoretically be able to exploit this flaw to execute arbitrary code if GSSAPI authentication is enabled.
The vendor credits Mark Dowd with reporting this vulnerability.
|
Impact:
A remote user can cause denial of service conditions.
A remote user may be able to execute arbitrary code on the target system.
|
Solution:
OpenBSD has issued the following patches:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/020_ssh2.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/015_ssh.patch
|
Vendor URL: www.openssh.org/txt/release-4.4 (Links to External Site)
|
Cause:
State error
|
Underlying OS:
UNIX (OpenBSD)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Thu, 12 Oct 2006 06:54:35 -0400
Subject: OpenBSD vulnerability
|
SECURITY FIX: October 12, 2006 All architectures
Fix 2 security bugs found in OpenSSH. A pre-authenication denial of service (found by
Tavis Ormandy) that would cause sshd(8) to spin until the login grace time expired. An
unsafe signal handler (found by Mark Dowd) that is vulnerable to a race condition that
could be exploited to perform a pre-authentication denial of service. CVE-2006-4924,
CVE-2006-5051
A source code patch exists which remedies this problem.
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/015_ssh.patch
|
|
