OpenSSH auth_password Function Denial of Service Vulnerability (CVE-2016-6515)

OpenSSH auth_password Function Denial of Service Vulnerability (CVE-2016-6515)
OpenSSH auth_password Function Denial of Service Vulnerability (CVE-2016-6515)

Release date:
Updated on:

Affected Systems:

OpenSSH OpenSSH < 7.3

Description:

CVE (CAN) ID: CVE-2016-6515

OpenSSH is an open-source implementation of the SSH protocol.

In OpenSSH versions earlier than 7.3, the sshd/auth-passwd.c/auth_password function does not limit the length of the password in password verification. Remote attackers exploit this vulnerability to cause a denial of service by passing a long string.

<* Source: vendor
*>

Suggestion:

Vendor patch:

OpenSSH
-------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://openwall.com/lists/oss-security/2016/08/01/2

Https://github.com/openssh/openssh-portable/commit/fcd135c9df440bcd2d5870405ad3311743d78d97

For more information about OpenSSH, see the following links:

Install and configure OpenSSH in Ubuntu Server 13.10

Install OpenSSH remotely on Ubuntu

Solve the latency problem during remote login through OpenSSH

Offline installation of OpenSSH in Ubuntu 12.10

OpenSSH upgrade steps and precautions

Solutions for failures of common OpenSSH users

General thread: OpenSSH key management, Part 1 Understanding RSA/DSA authentication

Install OpenSSH and configure the sftp lock directory for RedHat

This article permanently updates the link address: