Arch Linux Security Advisory ASA-201507-17 ========================================== Severity: Medium Date : 2015-07-23 CVE-ID : CVE-2015-5600 Package : openssh Type : authentication limits bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package openssh before version 6.9p1-2 is vulnerable to authentication limits bypass. Resolution ========== Upgrade to 6.9p1-2. # pacman -Syu "openssh>=6.9p1-2" The problems have been fixed upstream but no release is available yet. Workaround ========== In case that public key authentication is properly configured and no challenge-response authentication is required, deactivating challenge-response and kbd-interactive authentication in /etc/ssh/sshd_config via the following property mitigates this issue: KbdInteractiveAuthentication no ChallengeResponseAuthentication no Description =========== The OpenSSH server normally wouldn't allow successive authentications that exceed the MaxAuthTries setting in sshd_config, however when using kbd-interactive challenge-response authentication the allowed login retries can be extended limited only by the LoginGraceTime setting, that can be more than 10000 tries (depends on the network speed), and even more for local attacks. Impact ====== A remote attacker is able to perform a brute-force attack by bypassing the authentication limits via keyboard-interactive challenge-response authentication. References ========== http://seclists.org/fulldisclosure/2015/Jul/92 https://access.redhat.com/security/cve/CVE-2015-5600