NVD

Id
26720  
Name
CVE-2015-5600  
Description
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list.  
Reject
 
CVSS Version
2  
CVSS Score
8.5  
Severity
High  
CVSS Base Score
8.5  
CVSS Impact Subscore
7.8  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:C)  
Pub Date
2017-01-19  
Published
2015-08-02  
Modified Date
2016-12-23  
Seq
2015-5600  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
141428 26720 CVE-2015-5600 http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth2-chall.c  View
141429 26720 CVE-2015-5600 http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth2-chall.c.diff?r1=1.42&r2=1.43&f=h  View
141430 26720 CVE-2015-5600 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10697  View
141431 26720 CVE-2015-5600 APPLE-SA-2015-08-13-2  View
141432 26720 CVE-2015-5600 FEDORA-2015-13469  View
141433 26720 CVE-2015-5600 FEDORA-2015-11981  View
141434 26720 CVE-2015-5600 SUSE-SU-2015:1581  View
141435 26720 CVE-2015-5600 [oss-security] 20150723 Re: CVE Request for OpenSSH vulnerability - authentication limits bypass  View
141436 26720 CVE-2015-5600 RHSA-2016:0466  View
141437 26720 CVE-2015-5600 20150717 OpenSSH keyboard-interactive authentication brute force vulnerability (MaxAuthTries bypass)  View
141438 26720 CVE-2015-5600 http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html  View
141439 26720 CVE-2015-5600 http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html  View
141440 26720 CVE-2015-5600 http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html  View
141441 26720 CVE-2015-5600 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html  View
141442 26720 CVE-2015-5600 http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html  View
141443 26720 CVE-2015-5600 75990  View
141444 26720 CVE-2015-5600 91787  View
141445 26720 CVE-2015-5600 92012  View
141446 26720 CVE-2015-5600 USN-2710-1  View
141447 26720 CVE-2015-5600 USN-2710-2  View
141448 26720 CVE-2015-5600 https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952480  View
141449 26720 CVE-2015-5600 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05128992  View
141450 26720 CVE-2015-5600 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667  View
141451 26720 CVE-2015-5600 https://kc.mcafee.com/corporate/index?page=content&id=SB10136  View
141452 26720 CVE-2015-5600 https://kc.mcafee.com/corporate/index?page=content&id=SB10157  View
141453 26720 CVE-2015-5600 GLSA-201512-04  View
141454 26720 CVE-2015-5600 https://support.apple.com/kb/HT205031  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
8649 JVNDB-2015-003969 Openssh の sshd の auth2-chall.c 内の kbdint_next_device 関数における総当り攻撃を実行される脆弱性 Openssh の sshd の auth2-chall.c 内の kbdint_next_device 関数は、単一コネクション内のキーボード対話 (keyboard-interactive) デバイスの処理を適切に制限しないため、総当たり (brute-force) 攻撃を実行される、またはサービス運用妨害 (CPU 資源の消費) 状態にされる脆弱性が存在します。 CVE-2015-5600 82825 CVE-2015-5600 26720 8.5 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-003969.html 2015-07-18 2016-07-27 View