CVE-2015-5600: High severity OpenBSD OpenSSH vulnerability
The kbdintnextdevice function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5600?
CVE-2015-5600 is classified as a high severity vulnerability due to its potential for facilitating brute-force attacks and denial of service.
How do I fix CVE-2015-5600?
To fix CVE-2015-5600, upgrade OpenSSH to version 6.9 or later.
What systems are affected by CVE-2015-5600?
CVE-2015-5600 affects OpenSSH versions up to and including 6.9.
What type of attacks can be executed using CVE-2015-5600?
CVE-2015-5600 can be exploited to perform brute-force attacks or cause denial of service through excess CPU consumption.
Is CVE-2015-5600 remote exploitable?
Yes, CVE-2015-5600 is remote exploitable, allowing attackers to target systems from a distance.