Lucene search

K
archlinuxArch LinuxASA-201507-17
HistoryJul 23, 2015 - 12:00 a.m.

openssh: authentication limits bypass

2015-07-2300:00:00
Arch Linux
lists.archlinux.org
69

0.164 Low

EPSS

Percentile

96.0%

The OpenSSH server normally wouldn’t allow successive authentications
that exceed the MaxAuthTries setting in sshd_config, however when using
kbd-interactive challenge-response authentication the allowed login
retries can be extended limited only by the LoginGraceTime setting, that
can be more than 10000 tries (depends on the network speed), and even
more for local attacks.

OSVersionArchitecturePackageVersionFilename
anyanyanyopenssh< 6.9p1-2UNKNOWN