OpenSSH Denial of Service Vulnerability via Unbounded Ping Packet Allocation
A vulnerability has been discovered in the OpenSSH package that can cause a denial of service condition. When an SSH server receives ping packets, it creates and stores pong packets in a memory buffer. These packets remain in the queue until the server/client key exchange is complete. A malicious client can exploit this behavior by continuously sending ping packets, which causes uncontrolled memory consumption. As a result, the server's resources can be exhausted, potentially rendering the server unavailable and disrupting normal operations.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
red hat red hat enterprise linux 6 |
||
red hat red hat enterprise linux 7 |
||
red hat red hat enterprise linux 8 |
||
red hat red hat enterprise linux 9 |
||
red hat red hat openshift container platform 4 |
Microsoft testing fix for Windows 11 bug breaking SSH connections By Sergiu Gatlan February 20, 2025 08:19 AM 0 Microsoft is not testing a fix for a longstanding known issue that is breaking SSH connections on some Windows 11 22H2 and 23H2 systems. On Tuesday, Microsoft started rolling Windows 11 Build 26100.3321 (KB5052093) Insiders in the Release Preview Channel on Windows 11 24H2 (Build 26100) with a fix for this bug. When it first acknowledged the issue in November, the company explained it ...
New OpenSSH flaws expose SSH servers to MiTM and DoS attacks By Bill Toulas February 18, 2025 12:07 PM 0 OpenSSH has released security updates addressing two vulnerabilities, a machine-in-the-middle (MitM) and a denial of service flaw, with one of the flaws introduced over a decade ago. Qualys discovered both vulnerabilities and demonstrated their exploitability to OpenSSH's maintainers. OpenSSH (Open Secure Shell) is a free, open-source implementation of the SSH (Secure Shell) protocol, which p...
Topics Security Off-Prem On-Prem Software Offbeat Special Features Vendor Voice Vendor Voice Resources Exploit code now available for MitM and DoS attacks
Researchers can disclose two brand-new vulnerabilities in OpenSSH now that patches have been released. Qualys discovered the bugs in January, per its disclosure timeline. These vulnerabilities allow miscreants to perform machine-in-the-middle (MitM) attacks on the OpenSSH client and pre-authentication denial-of-service (DoS) attacks. Patches for CVE-2025-26465 and CVE-2025-26466 were released this morning. Although their respective severity scores (6.8 and 5.9) don't necessarily scream "patch me...
Vulmon