7.5high
CVE-2016-6515in critical feed1 exploit
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, whic…
Published 10 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
58.6%
percentile 99%
Public exploits
1
Exploit-DB
Summary
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
Exploit prediction (EPSS)
58.57% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.
Exploits and detections
- EDB-40888 OpenSSH 7.2 - Denial of Service · dos · 2016-12-07
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 7.8 | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Classification
- Weakness
- CWE-20 Improper Input Validation
References
- support.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03779en_us · x_transferred
- security.netapp.com /advisory/ntap-20171130-0003/ · x_transferred
- github.com /openssh/openssh-portable/commit/fcd135c9df440bcd2d5870405ad3311743d78d97 · x_transferred
- packetstormsecurity.com /files/140070/OpenSSH-7.2-Denial-Of-Service.html · x_transferred
- exploit-db.com /exploits/40888/ · exploit, x_transferred
- securityfocus.com /bid/92212 · vdb-entry, x_transferred
- security.freebsd.org /advisories/FreeBSD-SA-17:06.openssh.asc · vendor-advisory, x_transferred
- oracle.com /technetwork/security-advisory/cpuoct2017-3236626.html · x_transferred
- securitytracker.com /id/1036487 · vdb-entry, x_transferred
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/X2L6RW34VFNXYNVVN2CN73YA · vendor-advisory, x_transferred
- access.redhat.com /errata/RHSA-2017:2029 · vendor-advisory, x_transferred
- lists.debian.org /debian-lts-announce/2018/09/msg00010.html · mailing-list, x_transferred
- openwall.com /lists/oss-security/2016/08/01/2 · mailing-list, x_transferred
- cert-portal.siemens.com /productcert/pdf/ssa-676336.pdf · x_transferred
- cert-portal.siemens.com /productcert/pdf/ssa-412672.pdf · x_transferred
Sources
- CVE List: CVE-2016-6515
- NVD: CVE-2016-6515
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.