CVE-2015-5600

HIGH

Description

The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list.

References

http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth2-chall.c

http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth2-chall.c.diff?r1=1.42&r2=1.43&f=h

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10697

http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html

http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165170.html

http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162955.html

http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html

http://openwall.com/lists/oss-security/2015/07/23/4

http://rhn.redhat.com/errata/RHSA-2016-0466.html

http://seclists.org/fulldisclosure/2015/Jul/92

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

http://www.securityfocus.com/bid/75990

http://www.securityfocus.com/bid/91787

http://www.securityfocus.com/bid/92012

http://www.securitytracker.com/id/1032988

http://www.ubuntu.com/usn/USN-2710-1

http://www.ubuntu.com/usn/USN-2710-2

https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952480

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05128992

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667

https://kc.mcafee.com/corporate/index?page=content&id=SB10136

https://kc.mcafee.com/corporate/index?page=content&id=SB10157

https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html

https://security.gentoo.org/glsa/201512-04

https://security.netapp.com/advisory/ntap-20151106-0001/

https://support.apple.com/kb/HT205031

Details

Source: MITRE

Published: 2015-08-03

Updated: 2018-09-11

Type: CWE-264

Risk Information

CVSS v2.0

Base Score: 8.5

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:C

Impact Score: 7.8

Exploitability Score: 10

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* versions up to 6.9 (inclusive)

Tenable Plugins

View all (33 total)

IDNameProductFamilySeverity
127415NewStart CGSL MAIN 4.05 : openssh-latest Multiple Vulnerabilities (NS-SA-2019-0146)NessusNewStart CGSL Local Security Checks
high
106497pfSense < 2.2.5 Multiple Vulnerabilities (SA-15_08)NessusFirewalls
high
91750OracleVM 3.2 : openssh (OVMSA-2016-0070)NessusOracleVM Local Security Checks
high
9309OpenSSH < 7.0 Multiple VulnerabilitiesNessus Network MonitorSSH
high
90342Oracle Linux 5 : openssh (ELSA-2016-3531)NessusOracle Linux Local Security Checks
high
90080Scientific Linux Security Update : openssh on SL6.x i386/x86_64 (20160321)NessusScientific Linux Local Security Checks
high
90079RHEL 6 : openssh (RHSA-2016:0466)NessusRed Hat Local Security Checks
high
90076OracleVM 3.3 / 3.4 : openssh (OVMSA-2016-0038)NessusOracleVM Local Security Checks
high
90075Oracle Linux 6 : openssh (ELSA-2016-0466)NessusOracle Linux Local Security Checks
high
90069CentOS 6 : openssh (CESA-2016:0466)NessusCentOS Local Security Checks
high
88812F5 Networks BIG-IP : OpenSSH vulnerability (K17113)NessusF5 Networks Local Security Checks
high
87567Scientific Linux Security Update : openssh on SL7.x x86_64 (20151119)NessusScientific Linux Local Security Checks
high
87545GLSA-201512-04 : OpenSSH: Multiple vulnerabilitiesNessusGentoo Local Security Checks
high
87351Amazon Linux AMI : openssh (ALAS-2015-625)NessusAmazon Linux Local Security Checks
high
87128CentOS 7 : openssh (CESA-2015:2088)NessusCentOS Local Security Checks
high
87019Oracle Linux 7 : openssh (ELSA-2015-2088)NessusOracle Linux Local Security Checks
high
86967RHEL 7 : openssh (RHSA-2015:2088)NessusRed Hat Local Security Checks
high
86695SUSE SLES11 Security Update : openssh (SUSE-SU-2015:1840-1) (Logjam)NessusSuSE Local Security Checks
high
8981Mac OS X < 10.10.5 Multiple VulnerabilitiesNessus Network MonitorOperating System Detection
high
86339SUSE SLED11 / SLES11 Security Update : openssh (SUSE-SU-2015:1695-1) (Logjam)NessusSuSE Local Security Checks
high
86122OpenSSH MaxAuthTries BypassNessusMisc.
high
86057SUSE SLED11 / SLES11 Security Update : openssh (SUSE-SU-2015:1581-1) (Logjam)NessusSuSE Local Security Checks
high
85941SUSE SLED11 Security Update : openssh (SUSE-SU-2015:1547-2) (Logjam)NessusSuSE Local Security Checks
high
85929SUSE SLES11 Security Update : openssh (SUSE-SU-2015:1547-1) (Logjam)NessusSuSE Local Security Checks
high
85928SUSE SLED12 / SLES12 Security Update : openssh (SUSE-SU-2015:1544-1) (Logjam)NessusSuSE Local Security Checks
high
85668Fedora 21 : openssh-6.6.1p1-16.fc21 (2015-13469)NessusFedora Local Security Checks
high
85533Ubuntu 12.04 LTS / 14.04 LTS / 15.04 : openssh regression (USN-2710-2)NessusUbuntu Local Security Checks
high
85445Ubuntu 12.04 LTS / 14.04 LTS / 15.04 : openssh vulnerabilities (USN-2710-1)NessusUbuntu Local Security Checks
high
85408Mac OS X 10.10.x < 10.10.5 Multiple VulnerabilitiesNessusMacOS X Local Security Checks
high
85382OpenSSH < 7.0 Multiple VulnerabilitiesNessusMisc.
high
85278Debian DLA-288-2 : openssh regression updateNessusDebian Local Security Checks
high
85133Fedora 22 : openssh-6.9p1-3.fc22 (2015-11981)NessusFedora Local Security Checks
high
85033FreeBSD : OpenSSH -- MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices (5b74a5bc-348f-11e5-ba05-c80aa9043978)NessusFreeBSD Local Security Checks
high