CVE-2008-4109 Denial of service in n/a
Remote attackers can cause denial of service via connection slot exhaustion due to unsafe signal handling in OpenSSH login timeouts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2008-4109?
CVE-2008-4109 is a medium-severity denial of service vulnerability in OpenSSH, published on 17 Sep 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A certain Debian patch for OpenSSH before 4.3p2-9etch3 on etch; before 4.6p1-1 on sid and lenny; and on other distributions such as SUSE uses functions that are not async-signal-safe in the signal handler for login timeouts, which allows remote attackers to cause a denial of service (connection slot exhaustion) via multiple login attempts. NOTE: this issue exists because of an incorrect fix for CVE-2006-5051.
Weakness: CWE-264
Which versions are affected by CVE-2008-4109?
It affects 1 product.
Products include OpenSSH.
How do I fix CVE-2008-4109?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2008-4109 being exploited?
There is no known exploitation of CVE-2008-4109 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in OpenSSH
Sources
Also known as DEBIAN-CVE-2008-4109, GHSA-6wrv-35h9-3pj7.