FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  362844
Date:      2014-07-24
Time:      20:12:51Z
Committer: ohauer

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
5709d244-4873-11e3-8a46-000d601460a4OpenSSH -- Memory corruption in sshd

The OpenSSH development team reports:

A memory corruption vulnerability exists in the post- authentication sshd process when an AES-GCM cipher (aes128-gcm@openssh.com or aes256-gcm@openssh.com) is selected during kex exchange.

If exploited, this vulnerability might permit code execution with the privileges of the authenticated user and may therefore allow bypassing restricted shell/command configurations.

Either upgrade to 6.4 or disable AES-GCM in the server configuration. The following sshd_config option will disable AES-GCM while leaving other ciphers active:

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc


Discovery 2013-11-07
Entry 2013-11-08
Modified 2013-11-13
openssh-portable
ge 6.2.p2,1 lt 6.4.p1,1

openssh-portable-base
ge 6.2.p2,1 lt 6.4.p1,1

http://www.openssh.com/txt/gcmrekey.adv
32db37a5-50c3-11db-acf3-000c6ec775d9openssh -- multiple vulnerabilities

Problem Description

The CRC compensation attack detector in the sshd(8) daemon, upon receipt of duplicate blocks, uses CPU time cubic in the number of duplicate blocks received. [CVE-2006-4924]

A race condition exists in a signal handler used by the sshd(8) daemon to handle the LoginGraceTime option, which can potentially cause some cleanup routines to be executed multiple times. [CVE-2006-5051]

Impact

An attacker sending specially crafted packets to sshd(8) can cause a Denial of Service by using 100% of CPU time until a connection timeout occurs. Since this attack can be performed over multiple connections simultaneously, it is possible to cause up to MaxStartups (10 by default) sshd processes to use all the CPU time they can obtain. [CVE-2006-4924]

The OpenSSH project believe that the race condition can lead to a Denial of Service or potentially remote code execution, but the FreeBSD Security Team has been unable to verify the exact impact. [CVE-2006-5051]

Workaround

The attack against the CRC compensation attack detector can be avoided by disabling SSH Protocol version 1 support in sshd_config(5).

There is no workaround for the second issue.


Discovery 2006-09-25
Entry 2006-09-30
openssh
lt 4.4,1

openssh-portable
lt 4.4.p1,1

20216
CVE-2006-4924
CVE-2006-5051
SA-06:22.openssh
http://www.openssh.com/txt/release-4.4
32db37a5-50c3-11db-acf3-000c6ec775d9openssh -- multiple vulnerabilities

Problem Description

The CRC compensation attack detector in the sshd(8) daemon, upon receipt of duplicate blocks, uses CPU time cubic in the number of duplicate blocks received. [CVE-2006-4924]

A race condition exists in a signal handler used by the sshd(8) daemon to handle the LoginGraceTime option, which can potentially cause some cleanup routines to be executed multiple times. [CVE-2006-5051]

Impact

An attacker sending specially crafted packets to sshd(8) can cause a Denial of Service by using 100% of CPU time until a connection timeout occurs. Since this attack can be performed over multiple connections simultaneously, it is possible to cause up to MaxStartups (10 by default) sshd processes to use all the CPU time they can obtain. [CVE-2006-4924]

The OpenSSH project believe that the race condition can lead to a Denial of Service or potentially remote code execution, but the FreeBSD Security Team has been unable to verify the exact impact. [CVE-2006-5051]

Workaround

The attack against the CRC compensation attack detector can be avoided by disabling SSH Protocol version 1 support in sshd_config(5).

There is no workaround for the second issue.


Discovery 2006-09-25
Entry 2006-09-30
openssh
lt 4.4,1

openssh-portable
lt 4.4.p1,1

20216
CVE-2006-4924
CVE-2006-5051
SA-06:22.openssh
http://www.openssh.com/txt/release-4.4