CVE-2006-0883 Denial of service in n/a
Remote attackers can cause denial of service on FreeBSD systems using OpenSSH with OpenPAM by repeatedly connecting and disconnecting during authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2006-0883?
CVE-2006-0883 is a medium-severity denial of service vulnerability in Freebsd Freebsd, published on 7 Mar 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenSSH on FreeBSD 5.3 and 5.4, when used with OpenPAM, does not properly handle when a forked child process terminates during PAM authentication, which allows remote attackers to cause a denial of service (client connection refusal) by connecting multiple times to the SSH server, waiting for the password prompt, then disconnecting.
Weakness: CWE-399
Which versions are affected by CVE-2006-0883?
It affects 2 products.
Products include Freebsd Freebsd, OpenSSH.
How do I fix CVE-2006-0883?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2006-0883 being exploited?
There is no known exploitation of CVE-2006-0883 in the wild and no public exploit code.
Other vulnerabilities in Freebsd Freebsd
Sources
Also known as DEBIAN-CVE-2006-0883, GHSA-9x7m-vh7w-2mvh.