OpenSSH: Denial of service

OpenSSH: Denial of service A flaw in the OpenSSH daemon allows remote unauthenticated attackers to cause a Denial of Service. openssh 2006-09-27 2006-09-27 148228 remote 4.3_p2-r5 4.3_p2-r5

OpenSSH is a free suite of applications for the SSH protocol, developed and maintained by the OpenBSD project.

Tavis Ormandy of the Google Security Team discovered a Denial of Service vulnerability in the SSH protocol version 1 CRC compensation attack detector.

A remote unauthenticated attacker may be able to trigger excessive CPU usage by sending a pathological SSH message, denying service to other legitimate users or processes.

The system administrator may disable SSH protocol version 1 in /etc/ssh/sshd_config.

All OpenSSH users should upgrade to the latest version:


    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-misc/openssh-4.3_p2-r5"

CVE-2006-4924 taviso vorlon078