[arch-security] [ASA-201507-17] openssh: authentication limits bypass

[Levente Polyak]

Arch Linux Security Advisory ASA-201507-17
==========================================

Severity: Medium
Date    : 2015-07-23
CVE-ID  : CVE-2015-5600
Package : openssh
Type    : authentication limits bypass
Remote  : Yes
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package openssh before version 6.9p1-2 is vulnerable to
authentication limits bypass.

Resolution
==========

Upgrade to 6.9p1-2.

# pacman -Syu "openssh>=6.9p1-2"

The problems have been fixed upstream but no release is available yet.

Workaround
==========

In case that public key authentication is properly configured and no
challenge-response authentication is required, deactivating
challenge-response and kbd-interactive authentication in
/etc/ssh/sshd_config via the following property mitigates this issue:

  KbdInteractiveAuthentication no
  ChallengeResponseAuthentication no

Description
===========

The OpenSSH server normally wouldn't allow successive authentications
that exceed the MaxAuthTries setting in sshd_config, however when using
kbd-interactive challenge-response authentication the allowed login
retries can be extended limited only by the LoginGraceTime setting, that
can be more than 10000 tries (depends on the network speed), and even
more for local attacks.

Impact
======

A remote attacker is able to perform a brute-force attack by bypassing
the authentication limits via keyboard-interactive challenge-response
authentication.

References
==========

http://seclists.org/fulldisclosure/2015/Jul/92
https://access.redhat.com/security/cve/CVE-2015-5600

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20150723/b0b4f009/attachment.asc>