Lucene search

K
freebsdFreeBSD73E9A137-6007-11E6-A6C3-14DAE9D210B8
HistoryNov 04, 2014 - 12:00 a.m.

FreeBSD -- Denial of service attack against sshd(8)

2014-11-0400:00:00
vuxml.freebsd.org
13

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.015 Low

EPSS

Percentile

87.1%

Problem Description:
Although OpenSSH is not multithreaded, when OpenSSH is
compiled with Kerberos support, the Heimdal libraries bring
in the POSIX thread library as a dependency. Due to incorrect
library ordering while linking sshd(8), symbols in the C
library which are shadowed by the POSIX thread library may
not be resolved correctly at run time.
Note that this problem is specific to the FreeBSD build
system and does not affect other operating systems or the
version of OpenSSH available from the FreeBSD ports tree.
Impact:
An incorrectly linked sshd(8) child process may deadlock
while handling an incoming connection. The connection may
then time out or be interrupted by the client, leaving the
deadlocked sshd(8) child process behind. Eventually, the
sshd(8) parent process stops accepting new connections.
An attacker may take advantage of this by repeatedly
connecting and then dropping the connection after having
begun, but not completed, the authentication process.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchfreebsd= 10.0UNKNOWN
FreeBSDanynoarchfreebsd< 10.0_12UNKNOWN

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.015 Low

EPSS

Percentile

87.1%

Related for 73E9A137-6007-11E6-A6C3-14DAE9D210B8