[arch-security] [ASA-201507-17] openssh: authentication limits bypass
anthraxx at archlinux.org
Thu Jul 23 17:48:19 UTC 2015
Arch Linux Security Advisory ASA-201507-17
Date : 2015-07-23
CVE-ID : CVE-2015-5600
Package : openssh
Type : authentication limits bypass
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE
The package openssh before version 6.9p1-2 is vulnerable to
authentication limits bypass.
Upgrade to 6.9p1-2.
# pacman -Syu "openssh>=6.9p1-2"
The problems have been fixed upstream but no release is available yet.
In case that public key authentication is properly configured and no
challenge-response authentication is required, deactivating
challenge-response and kbd-interactive authentication in
/etc/ssh/sshd_config via the following property mitigates this issue:
The OpenSSH server normally wouldn't allow successive authentications
that exceed the MaxAuthTries setting in sshd_config, however when using
kbd-interactive challenge-response authentication the allowed login
retries can be extended limited only by the LoginGraceTime setting, that
can be more than 10000 tries (depends on the network speed), and even
more for local attacks.
A remote attacker is able to perform a brute-force attack by bypassing
the authentication limits via keyboard-interactive challenge-response
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 819 bytes
Desc: OpenPGP digital signature
More information about the arch-security