// For flags

CVE-2016-6515

OpenSSH 7.2 - Denial of Service

Severity Score

7.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

5
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.

La función auth_password en auth-passwd.c en sshd en OpenSSH en versiones anteriores a 7.3 no limita longitudes de contraseña para autenticación de contraseña, lo que permite a atacantes remotos provocar una denegación de servicio (consumo de CPU clave) a través de una cadena larga.

It was found that OpenSSH did not limit password lengths for password authentication. A remote unauthenticated attacker could use this flaw to temporarily trigger high CPU consumption in sshd by sending long passwords.

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. The following packages have been upgraded to a later upstream version: openssh. Security Fix: A covert timing channel flaw was found in the way OpenSSH handled authentication of non-existent users. A remote unauthenticated attacker could possibly use this flaw to determine valid user names by measuring the timing of server responses.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Complete
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2016-08-01 CVE Reserved
  • 2016-08-07 CVE Published
  • 2016-12-08 First Exploit
  • 2024-08-06 CVE Updated
  • 2026-04-05 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-20: Improper Input Validation
  • CWE-770: Allocation of Resources Without Limits or Throttling
CAPEC
References (21)
URL Tag Source
http://openwall.com/lists/oss-security/2016/08/01/2 Mailing List
http://packetstormsecurity.com/files/140070/OpenSSH-7.2-Denial-Of-Service.html
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
http://www.securityfocus.com/bid/92212 Vdb Entry
http://www.securitytracker.com/id/1036487 Vdb Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-676336.pdf
https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html Mailing List
https://security.netapp.com/advisory/ntap-20171130-0003
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03779en_us
URL Date SRC
https://packetstorm.news/files/id/140070 2016-12-08
https://www.exploit-db.com/exploits/40888 2024-08-06
https://github.com/opsxcq/exploit-CVE-2016-6515 2017-09-10
https://github.com/cved-sources/cve-2016-6515 2021-04-15
https://github.com/jptr218/openssh_dos 2021-08-26
URL Date SRC
https://github.com/openssh/openssh-portable/commit/fcd135c9df440bcd2d5870405ad3311743d78d97 2023-11-07
URL Date SRC
https://access.redhat.com/errata/RHSA-2017:2029 2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X2L6RW34VFNXYNVVN2CN73YAGJ5VMTFU 2023-11-07
https://security.FreeBSD.org/advisories/FreeBSD-SA-17:06.openssh.asc 2023-11-07
https://access.redhat.com/security/cve/CVE-2016-6515 2017-08-01
https://bugzilla.redhat.com/show_bug.cgi?id=1364935 2017-08-01
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 <= 7.2
Search vendor "Openbsd" for product "Openssh" and version " <= 7.2"
p2
Affected
Fedoraproject
Search vendor "Fedoraproject"
 Fedora
Search vendor "Fedoraproject" for product "Fedora"
 24
Search vendor "Fedoraproject" for product "Fedora" and version "24"
-
Affected