Lucene search
HistorySep 18, 2008 - 3:04 p.m.
CVE-2008-4109
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
7.8 High
AI Score
Confidence
High
0.725 High
EPSS
Percentile
98.1%
A certain Debian patch for OpenSSH before 4.3p2-9etch3 on etch; before 4.6p1-1 on sid and lenny; and on other distributions such as SUSE uses functions that are not async-signal-safe in the signal handler for login timeouts, which allows remote attackers to cause a denial of service (connection slot exhaustion) via multiple login attempts. NOTE: this issue exists because of an incorrect fix for CVE-2006-5051.
Affected configurations
Node
debianlinuxMatchunknownunknownetch
openbsdopensshRange≤4.3p2
ORopenbsdopensshMatch1.2
ORopenbsdopensshMatch1.2.1
ORopenbsdopensshMatch1.2.2
ORopenbsdopensshMatch1.2.3
ORopenbsdopensshMatch1.2.27
ORopenbsdopensshMatch1.3
ORopenbsdopensshMatch1.5
ORopenbsdopensshMatch1.5.7
ORopenbsdopensshMatch1.5.8
ORopenbsdopensshMatch2
ORopenbsdopensshMatch2.1
ORopenbsdopensshMatch2.1.1
ORopenbsdopensshMatch2.2
ORopenbsdopensshMatch2.3
ORopenbsdopensshMatch2.3.1
ORopenbsdopensshMatch2.5
ORopenbsdopensshMatch2.5.1
ORopenbsdopensshMatch2.5.2
ORopenbsdopensshMatch2.9
ORopenbsdopensshMatch2.9.9
ORopenbsdopensshMatch2.9.9p2
ORopenbsdopensshMatch2.9p1
ORopenbsdopensshMatch2.9p2
ORopenbsdopensshMatch3.0
ORopenbsdopensshMatch3.0.1
ORopenbsdopensshMatch3.0.1p1
ORopenbsdopensshMatch3.0.2
ORopenbsdopensshMatch3.0.2p1
ORopenbsdopensshMatch3.0p1
ORopenbsdopensshMatch3.1
ORopenbsdopensshMatch3.1p1
ORopenbsdopensshMatch3.2
ORopenbsdopensshMatch3.2.2
ORopenbsdopensshMatch3.2.2p1
ORopenbsdopensshMatch3.2.3p1
ORopenbsdopensshMatch3.3
ORopenbsdopensshMatch3.3p1
ORopenbsdopensshMatch3.4
ORopenbsdopensshMatch3.4p1
ORopenbsdopensshMatch3.5
ORopenbsdopensshMatch3.5p1
ORopenbsdopensshMatch3.6
ORopenbsdopensshMatch3.6.1
ORopenbsdopensshMatch3.6.1p1
ORopenbsdopensshMatch3.6.1p2
ORopenbsdopensshMatch3.7
ORopenbsdopensshMatch3.7.1
ORopenbsdopensshMatch3.7.1p1
ORopenbsdopensshMatch3.7.1p2
ORopenbsdopensshMatch3.8
ORopenbsdopensshMatch3.8.1
ORopenbsdopensshMatch3.8.1p1
ORopenbsdopensshMatch3.9
ORopenbsdopensshMatch3.9.1
ORopenbsdopensshMatch3.9.1p1
ORopenbsdopensshMatch4.0
ORopenbsdopensshMatch4.0p1
ORopenbsdopensshMatch4.1
ORopenbsdopensshMatch4.1p1
ORopenbsdopensshMatch4.2
ORopenbsdopensshMatch4.2p1
ORopenbsdopensshMatch4.3
ORopenbsdopensshMatch4.3p1
Node
debianlinuxMatchunknownunknownsid
openbsdopensshRange≤4.6
ORopenbsdopensshMatch1.2
ORopenbsdopensshMatch1.2.1
ORopenbsdopensshMatch1.2.2
ORopenbsdopensshMatch1.2.3
ORopenbsdopensshMatch1.2.27
ORopenbsdopensshMatch1.3
ORopenbsdopensshMatch1.5
ORopenbsdopensshMatch1.5.7
ORopenbsdopensshMatch1.5.8
ORopenbsdopensshMatch2
ORopenbsdopensshMatch2.1
ORopenbsdopensshMatch2.1.1
ORopenbsdopensshMatch2.2
ORopenbsdopensshMatch2.3
ORopenbsdopensshMatch2.3.1
ORopenbsdopensshMatch2.5
ORopenbsdopensshMatch2.5.1
ORopenbsdopensshMatch2.5.2
ORopenbsdopensshMatch2.9
ORopenbsdopensshMatch2.9.9
ORopenbsdopensshMatch2.9.9p2
ORopenbsdopensshMatch2.9p1
ORopenbsdopensshMatch2.9p2
ORopenbsdopensshMatch3.0
ORopenbsdopensshMatch3.0.1
ORopenbsdopensshMatch3.0.1p1
ORopenbsdopensshMatch3.0.2
ORopenbsdopensshMatch3.0.2p1
ORopenbsdopensshMatch3.0p1
ORopenbsdopensshMatch3.1
ORopenbsdopensshMatch3.1p1
ORopenbsdopensshMatch3.2
ORopenbsdopensshMatch3.2.2
ORopenbsdopensshMatch3.2.2p1
ORopenbsdopensshMatch3.2.3p1
ORopenbsdopensshMatch3.3
ORopenbsdopensshMatch3.3p1
ORopenbsdopensshMatch3.4
ORopenbsdopensshMatch3.4p1
ORopenbsdopensshMatch3.5
ORopenbsdopensshMatch3.5p1
ORopenbsdopensshMatch3.6
ORopenbsdopensshMatch3.6.1
ORopenbsdopensshMatch3.6.1p1
ORopenbsdopensshMatch3.6.1p2
ORopenbsdopensshMatch3.7
ORopenbsdopensshMatch3.7.1
ORopenbsdopensshMatch3.7.1p1
ORopenbsdopensshMatch3.7.1p2
ORopenbsdopensshMatch3.8
ORopenbsdopensshMatch3.8.1
ORopenbsdopensshMatch3.8.1p1
ORopenbsdopensshMatch3.9
ORopenbsdopensshMatch3.9.1
ORopenbsdopensshMatch3.9.1p1
ORopenbsdopensshMatch4.0
ORopenbsdopensshMatch4.0p1
ORopenbsdopensshMatch4.1
ORopenbsdopensshMatch4.1p1
ORopenbsdopensshMatch4.2
ORopenbsdopensshMatch4.2p1
ORopenbsdopensshMatch4.3
ORopenbsdopensshMatch4.3p1
ORopenbsdopensshMatch4.3p2
ORopenbsdopensshMatch4.4
ORopenbsdopensshMatch4.4p1
References
bugs.debian.org/cgi-bin/bugreport.cgi?bug=498678
lists.opensuse.org/opensuse-security-announce/2008-10/msg00004.html
secunia.com/advisories/31885
secunia.com/advisories/32080
secunia.com/advisories/32181
www.debian.org/security/2008/dsa-1638
www.securitytracker.com/id?1020891
www.ubuntu.com/usn/usn-649-1
exchange.xforce.ibmcloud.com/vulnerabilities/45202
Related
openvas
openvas
Debian Security Advisory DSA 1638-1 (openssh)
2008-09-24 00:00:00
Debian: Security Advisory (DSA-1638-1)
2008-09-24 00:00:00
SLES10: Security update for OpenSSH
2009-10-13 00:00:00
debian
debian
[SECURITY] [DSA 1638-1] New openssh packages fix denial of service
2008-09-16 20:41:23
[SECURITY] [DSA 1189-1] New openssh-krb5 packages fix denial of service and potential execution of arbitrary code
2006-10-04 19:32:23
[SECURITY] [DSA 1212-1] New openssh packages fix denial of service
2006-11-15 17:26:52
ubuntucve
ubuntucve
CVE-2008-4109
2008-09-18 00:00:00
CVE-2006-5051
2006-09-27 00:00:00
cvelist
cvelist
CVE-2008-4109
2008-09-17 18:06:00
CVE-2006-5051
2006-09-27 23:00:00
f5
f5
K14742 : OpenSSH vulnerability CVE-2008-4109
2014-07-30 00:00:00
SOL14742 - OpenSSH vulnerability CVE-2008-4109
2013-10-10 00:00:00
K6736 : OpenSSH vulnerabilities CAN-2006-5051, CAN-2006-4924
2013-03-27 00:00:00
prion
prion
Code injection
2008-09-18 15:04:00
securityvulns
securityvulns
Multiple OpenSSH security vulnerabilities
2008-10-03 00:00:00
[SECURITY] [DSA 1638-1] New openssh packages fix denial of service
2008-09-20 00:00:00
[USN-649-1] OpenSSH vulnerabilities
2008-10-03 00:00:00
nessus
nessus
Debian DSA-1638-1 : openssh - denial of service
2008-09-17 00:00:00
Ubuntu 5.04 / 5.10 / 6.06 LTS : openssh vulnerabilities (USN-355-1)
2007-11-10 00:00:00
Ubuntu 6.06 LTS / 7.04 / 7.10 : openssh vulnerabilities (USN-649-1)
2009-04-23 00:00:00
osv
osv
openssh - denial of service
2008-09-16 00:00:00
openssh
2006-11-15 00:00:00
openssh-krb5
2006-10-04 00:00:00
redhatcve
redhatcve
CVE-2008-4109
2015-10-30 10:23:32
debiancve
debiancve
CVE-2008-4109
2008-09-18 15:04:27
CVE-2006-5051
2006-09-27 23:07:00
cve
cve
CVE-2008-4109
2008-09-18 15:04:27
CVE-2006-5051
2006-09-27 23:07:00
nvd
nvd
CVE-2006-5051
2006-09-27 23:07:00
cert
cert
OpenSSH contains a race condition vulnerability
2006-10-04 00:00:00
redhat
redhat
(RHSA-2006:0697) openssh security update
2006-09-28 00:00:00
(RHSA-2006:0698) openssh security update
2006-09-28 00:00:00
freebsd
freebsd
openssh -- multiple vulnerabilities
2006-09-25 00:00:00
gentoo
gentoo
OpenSSH: Multiple Denial of Service vulnerabilities
2006-11-13 00:00:00
ubuntu
ubuntu
openssh vulnerabilities
2006-10-02 00:00:00
OpenSSH vulnerabilities
2008-10-01 00:00:00
checkpoint_security
checkpoint_security
OpenSSH vulnerabilities: CVE-2006-5051 and CVE-2006-4924
2006-11-19 22:00:00
freebsd_advisory
freebsd_advisory
FreeBSD-SA-06:22.openssh
2006-09-30 00:00:00
centos
centos
openssh, openssl, openssl096b security update
2006-09-29 03:31:38
openssh security update
2006-10-02 01:42:56
oraclelinux
oraclelinux
Important openssh security update
2006-11-30 00:00:00
slackware
slackware
[slackware-security] openssh
2006-09-29 07:57:38
fedora
fedora
[SECURITY] Fedora Core 5 Update: openssh-4.3p2-4.12.fc5
2007-04-03 21:39:33
suse
suse
remote denial of service in openssh
2006-10-20 14:30:36
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
7.8 High
AI Score
Confidence
High
0.725 High
EPSS
Percentile
98.1%
Related for NVD:CVE-2008-4109