#VU1033 Denial of service in OpenSSH - CVE-2016-8858

Vulnerability identifier: #VU1033

Vulnerability risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2016-8858

CWE-ID: CWE-401

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
OpenSSH
Server applications / Remote management servers, RDP, SSH

Vendor: OpenSSH

Description
The vulnerability allows a remote unauthenticated attacker to cause DoS conditions on the target system.

The weakness is due to flaw in kex_input_kexinit() function. By sending a specially crafted data during the key exchange process, attackers can cause memory exhaustion. Consuming up to 128 MB per connection may lead to denial of service.

Successful exploitation of the vulnerability results in denial of service of the vulnerable system.

Mitigation
Install the latest OpenSSH version 7.4.

Vulnerable software versions

OpenSSH: 7.0p1 - 7.3p1

---

External links
https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/kex.c?rev=1.127&content-type=text/x-cvsweb-markup
https://www.openssh.com/txt/release-7.4

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.