Vulnerability in OpenBSD OpenSSH
CVE-2008-4109
A certain Debian patch for OpenSSH before 4.3p2-9etch3 on etch; before 4.6p1-1 on sid and lenny; and on other distributions such as SUSE uses functions that are not async-signal-safe in the signal handler for login timeouts, which allows remote attackers to cause a denial of service (connection slot exhaustion) via multiple login attempts. NOTE: this issue exists because of an incorrect fix for CVE-2006-5051.
EPSS: 0.284 (98.0th percentile) — read the EPSS interpretation.
Affected products
- Openbsd Openssh — versions 1.2, 1.2.1, 1.2.2
- Debian Linux — versions unknown
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
- bigb0x/CVE-2024-6387
- David-M-Berry/openssh-cve-discovery
- Passyed/regreSSHion-Fix
- TAM-K592/CVE-2024-6387
- almogopp/OpenSSH-CVE-2024-6387-Fix
- azurejoga/CVE-2024-6387-how-to-fix
- CVEDB/awesome-cve-repo
- edsonjt81/https-github.com-gotr00t0day-OpenSSH-Scanner
- invaderslabs/regreSSHion-CVE-2024-6387-
- kalvin-net/NoLimit-Secu-RegreSSHion
References
- cve@mitre.org (vendor-advisory)
- cve@mitre.org (vdb-entry)
- cve@mitre.org (third-party-advisory)
- cve@mitre.org (vdb-entry)
- cve@mitre.org (vendor-advisory, Patch)
- cve@mitre.org (vendor-advisory)
- cve@mitre.org (third-party-advisory)
- cve@mitre.org
- cve@mitre.org (third-party-advisory)
- cve@mitre.org (mailing-list)
Frequently asked questions
- What is CVE-2008-4109?
- CVE-2008-4109 is a vulnerability in OpenBSD OpenSSH, classified under CWE-264. Published 2008-09-18.
- Is CVE-2008-4109 known to be exploited?
- 13 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.