OpenSSH 'ssh _ gssapi_parse_ename () 'Function Denial of Service Vulnerability

Release date:
Updated on:

Affected Systems:
OpenSSH <5.8
Description:
--------------------------------------------------------------------------------
Bugtraq id: 54114
CVE (CAN) ID: CVE-2011-5000

OpenSSH replaces telnet, ftp, rlogin, rsh, and rcp with secure and encrypted network connection tools.

The ssh_gssapi_parse_ename function in the gss-serv.c in OpenSSH 5.8 causes a denial of service (memory consumption) through some length fields after gssapi-with-mic verification is enabled ).

<* Source: Red Hat
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

OpenSSH
-------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.openssh.com/