#VU33288 Permissions, Privileges, and Access Controls in OpenSSH - CVE-2015-5600
Vulnerability identifier: #VU33288
Vulnerability risk: High
CVSSv4.0: 6.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2015-5600
CWE-ID:
CWE-264
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
OpenSSH
Server applications /
Remote management servers, RDP, SSH
Vendor: OpenSSH
Description
The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list.
Mitigation
Install update from vendor's website.
Vulnerable software versions
OpenSSH: 6.0 - 6.9
External links
https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth2-chall.c
https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth2-chall.c.diff?r1=1.42&r2=1.43&f=h
https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10697
https://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
https://lists.fedoraproject.org/pipermail/package-announce/2015-August/165170.html
https://lists.fedoraproject.org/pipermail/package-announce/2015-July/162955.html
https://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html
https://openwall.com/lists/oss-security/2015/07/23/4
https://rhn.redhat.com/errata/RHSA-2016-0466.html
https://seclists.org/fulldisclosure/2015/Jul/92
https://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
https://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
https://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
https://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
https://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
https://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
https://www.securityfocus.com/bid/75990
https://www.securityfocus.com/bid/91787
https://www.securityfocus.com/bid/92012
https://www.securitytracker.com/id/1032988
https://www.ubuntu.com/usn/USN-2710-1
https://www.ubuntu.com/usn/USN-2710-2
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952480
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05128992
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667
https://kc.mcafee.com/corporate/index?page=content&id=SB10136
https://kc.mcafee.com/corporate/index?page=content&id=SB10157
https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html
https://security.gentoo.org/glsa/201512-04
https://security.netapp.com/advisory/ntap-20151106-0001/
https://support.apple.com/kb/HT205031
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
