CVE-2015-5600
HIGHOpenSSH < 6.9 - Denial of Service via Keyboard-Interactive Device List
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2015-5600. PoCs published by Abdirisaq-ali-aynab.
AI-analyzed exploit summary This repository provides a detailed vulnerability assessment for OpenSSH 6.6.1p1, including technical analysis of CVE-2015-5600 and other CVEs, remediation steps, and MITRE ATT&CK mapping. It does not contain exploit code but offers in-depth security research.
Description
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list.
Exploits (2)
This repository provides a detailed vulnerability assessment for OpenSSH 6.6.1p1, including technical analysis of CVE-2015-5600 and other CVEs, remediation steps, and MITRE ATT&CK mapping. It does not contain exploit code but offers in-depth security research.
This repository contains a detailed vulnerability assessment writeup for OpenSSH 6.6.1p1, focusing on CVE-2015-5600 and other related CVEs. It includes technical analysis, remediation steps, and MITRE ATT&CK mappings but does not contain exploit code.
References (33)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H