SB2016051109 - Permissions, privileges, and access controls in HPE 3PAR OS running OpenSSH

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2016051109

SB2016051109 - Permissions, privileges, and access controls in HPE 3PAR OS running OpenSSH

Published: May 11, 2016 Updated: April 26, 2023

Security Bulletin ID SB2016051109
Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2015-5600)

The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.

The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list.


Remediation

Install update from vendor's website.

References