Published: 05/04/2012 Updated: 22/07/2012

CVSS v2 Base Score: 3.5 | Impact Score: 2.9 | Exploitability Score: 6.8

VMScore: 314

Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P

The ssh_gssapi_parse_ename function in gss-serv.c in OpenSSH 5.8 and previous versions, when gssapi-with-mic authentication is enabled, allows remote authenticated users to cause a denial of service (memory consumption) via a large value in a certain length field. NOTE: there may be limited scenarios in which this issue is relevant.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openbsd openssh 5.5
openbsd openssh 5.4
openbsd openssh 4.6
openbsd openssh 4.5
openbsd openssh 4.0
openbsd openssh 4.1
openbsd openssh 3.8.1p1
openbsd openssh 3.9
openbsd openssh 3.0p1
openbsd openssh 3.0.2
openbsd openssh 3.5p1
openbsd openssh 3.6
openbsd openssh 3.2.2
openbsd openssh 3.2.2p1
openbsd openssh 1.2.3
openbsd openssh 1.2.1
openbsd openssh
openbsd openssh 5.1
openbsd openssh 5.0
openbsd openssh 4.1p1
openbsd openssh 4.3p2
openbsd openssh 4.4
openbsd openssh 3.7.1p2
openbsd openssh 3.0.2p1
openbsd openssh 3.1
openbsd openssh 3.2
openbsd openssh 3.6.1p2
openbsd openssh 3.7
openbsd openssh 3.3p1
openbsd openssh 3.4
openbsd openssh 1.5.7
openbsd openssh 1.5.8
openbsd openssh 1.3
openbsd openssh 5.7
openbsd openssh 5.6
openbsd openssh 4.9
openbsd openssh 4.8
openbsd openssh 4.7
openbsd openssh 4.3p1
openbsd openssh 4.4p1
openbsd openssh 3.8
openbsd openssh 3.8.1
openbsd openssh 3.1p1
openbsd openssh 3.0.1
openbsd openssh 3.7.1
openbsd openssh 3.7.1p1
openbsd openssh 3.4p1
openbsd openssh 3.5
openbsd openssh 1.5
openbsd openssh 1.2.27
openbsd openssh 5.3
openbsd openssh 5.2
openbsd openssh 4.0p1
openbsd openssh 4.2p1
openbsd openssh 4.2
openbsd openssh 4.3
openbsd openssh 3.9.1
openbsd openssh 3.9.1p1
openbsd openssh 3.0.1p1
openbsd openssh 3.0
openbsd openssh 3.6.1
openbsd openssh 3.6.1p1
openbsd openssh 3.2.3p1
openbsd openssh 3.3
openbsd openssh 1.2.2
openbsd openssh 1.2

Synopsis Low: openssh security, bug fix, and enhancement update Type/Severity Security Advisory: Low Topic Updated openssh packages that fix one security issue, several bugs, and addvarious enhancements are now available for Red Hat Enterprise Linux 6The Red Hat Security Response Team has rated this update ...

A denial of service flaw was found in the OpenSSH GSSAPI authentication implementation A remote, authenticated user could use this flaw to make the OpenSSH server daemon (sshd) use an excessive amount of memory, leading to a denial of service GSSAPI authentication is enabled by default ("GSSAPIAuthentication yes" in "/etc/ssh/sshd_config") (CVE- ...

CWE-189 http://site.pi3.com.pl/adv/ssh_1.txt http://seclists.org/fulldisclosure/2011/Aug/2 http://rhn.redhat.com/errata/RHSA-2012-0884.html https://access.redhat.com/errata/RHSA-2012:0884 https://nvd.nist.gov https://alas.aws.amazon.com/ALAS-2012-99.html

CVE-2011-5000

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect