Vulnerability in Freebsd

CVE-2006-0883

OpenSSH on FreeBSD 5.3 and 5.4, when used with OpenPAM, does not properly handle when a forked child process terminates during PAM authentication, which allows remote attackers to cause a denial of service (client connection refusal) by connecting multiple times to the SSH server, waiting for the password prompt, then disconnecting.

EPSS: 0.019 (77.2th percentile) — read the EPSS interpretation.

Affected products

Freebsd — versions 5.3, 5.4
Openbsd Openssh — versions 3.8.1p1
N/a — versions n/a

Weakness classification (CWE)

CWE-399

References

secteam@freebsd.org (vdb-entry, x_refsource_VUPEN, Vendor Advisory)
secteam@freebsd.org (x_refsource_OSVDB, vdb-entry)
secteam@freebsd.org (Patch, vdb-entry, x_refsource_SECTRACK)
secteam@freebsd.org (x_refsource_SREASON, third-party-advisory)
secteam@freebsd.org (Patch, vdb-entry, x_refsource_BID)
secteam@freebsd.org (vdb-entry, x_refsource_XF)
secteam@freebsd.org (x_refsource_CONFIRM)