CVE-2011-5000 Denial of service in n/a

Low 3.5 Published 4 Apr 2012 Updated 7 Aug 2024

Remote authenticated users can cause a denial of service via memory consumption in OpenSSH when GSSAPI authentication is enabled.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2011-5000?

CVE-2011-5000 is a low-severity denial of service vulnerability in OpenSSH, published on 4 Apr 2012. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The ssh_gssapi_parse_ename function in gss-serv.c in OpenSSH 5.8 and earlier, when gssapi-with-mic authentication is enabled, allows remote authenticated users to cause a denial of service (memory consumption) via a large value in a certain length field. NOTE: there may be limited scenarios in which this issue is relevant.

Weakness: CWE-189

Which versions are affected by CVE-2011-5000?

It affects 1 product.

Linux distribution packages (28)

`openssh` Red Hat:enterprise_linux:6::client	All versions	`0:5.3p1-81.el6`
`openssh-askpass` Red Hat:enterprise_linux:6::client	All versions	`0:5.3p1-81.el6`
`openssh-clients` Red Hat:enterprise_linux:6::client	All versions	`0:5.3p1-81.el6`
`openssh-debuginfo` Red Hat:enterprise_linux:6::client	All versions	`0:5.3p1-81.el6`
`openssh-ldap` Red Hat:enterprise_linux:6::client	All versions	`0:5.3p1-81.el6`
`openssh-server` Red Hat:enterprise_linux:6::client	All versions	`0:5.3p1-81.el6`
`pam_ssh_agent_auth` Red Hat:enterprise_linux:6::client	All versions	`0:0.9-81.el6`
`openssh` Red Hat:enterprise_linux:6::computenode	All versions	`0:5.3p1-81.el6`
`openssh-askpass` Red Hat:enterprise_linux:6::computenode	All versions	`0:5.3p1-81.el6`
`openssh-clients` Red Hat:enterprise_linux:6::computenode	All versions	`0:5.3p1-81.el6`
`openssh-debuginfo` Red Hat:enterprise_linux:6::computenode	All versions	`0:5.3p1-81.el6`
`openssh-ldap` Red Hat:enterprise_linux:6::computenode	All versions	`0:5.3p1-81.el6`
`openssh-server` Red Hat:enterprise_linux:6::computenode	All versions	`0:5.3p1-81.el6`
`pam_ssh_agent_auth` Red Hat:enterprise_linux:6::computenode	All versions	`0:0.9-81.el6`
`openssh` Red Hat:enterprise_linux:6::server	All versions	`0:5.3p1-81.el6`
`openssh-askpass` Red Hat:enterprise_linux:6::server	All versions	`0:5.3p1-81.el6`
`openssh-clients` Red Hat:enterprise_linux:6::server	All versions	`0:5.3p1-81.el6`
`openssh-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`0:5.3p1-81.el6`
`openssh-ldap` Red Hat:enterprise_linux:6::server	All versions	`0:5.3p1-81.el6`
`openssh-server` Red Hat:enterprise_linux:6::server	All versions	`0:5.3p1-81.el6`
`pam_ssh_agent_auth` Red Hat:enterprise_linux:6::server	All versions	`0:0.9-81.el6`
`openssh` Red Hat:enterprise_linux:6::workstation	All versions	`0:5.3p1-81.el6`
`openssh-askpass` Red Hat:enterprise_linux:6::workstation	All versions	`0:5.3p1-81.el6`
`openssh-clients` Red Hat:enterprise_linux:6::workstation	All versions	`0:5.3p1-81.el6`
`openssh-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`0:5.3p1-81.el6`
`openssh-ldap` Red Hat:enterprise_linux:6::workstation	All versions	`0:5.3p1-81.el6`
`openssh-server` Red Hat:enterprise_linux:6::workstation	All versions	`0:5.3p1-81.el6`
`pam_ssh_agent_auth` Red Hat:enterprise_linux:6::workstation	All versions	`0:0.9-81.el6`

Products include OpenSSH.

How do I fix CVE-2011-5000?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2011-5000 being exploited?

There is no known exploitation of CVE-2011-5000 in the wild and no public exploit code.

All OpenSSH vulnerabilities

Sources

Also known as DEBIAN-CVE-2011-5000, GHSA-wq52-9gh8-cwrp, RHSA-2012:0884.