CVE-2006-0883
published 2006-03-07CVE-2006-0883: OpenSSH on FreeBSD 5.3 and 5.4, when used with OpenPAM, does not properly handle when a forked child process terminates during PAM authentication, which allows…
PriorityP424medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
1.88%
76.8th percentile
OpenSSH on FreeBSD 5.3 and 5.4, when used with OpenPAM, does not properly handle when a forked child process terminates during PAM authentication, which allows remote attackers to cause a denial of service (client connection refusal) by connecting multiple times to the SSH server, waiting for the password prompt, then disconnecting.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openssh | < openssh 1:3.8.1p1-4 (bookworm) | openssh 1:3.8.1p1-4 (bookworm) |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | >= 0 < 1:3.8.1p1-4 | 1:3.8.1p1-4 |
| openbsd | openssh | >= 0 < 1:3.8.1p1-4 | 1:3.8.1p1-4 |
| openbsd | openssh | >= 0 < 1:3.8.1p1-4 | 1:3.8.1p1-4 |
| openbsd | openssh | >= 0 < 1:3.8.1p1-4 | 1:3.8.1p1-4 |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.0MEDIUM
vendor_debian5.0MEDIUM
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
BSD
FreeBSD-SA-06:09.openssh: Remote denial of service in OpenSSH
bsd_advisories·2006-03-01·CVSS 5.0
CVE-2006-0883 [MEDIUM] FreeBSD-SA-06:09.openssh: Remote denial of service in OpenSSH
FreeBSD-SA-06:09.openssh Security Advisory
The FreeBSD Project
Topic: Remote denial of service in OpenSSH
Category: contrib
Module: OpenSSH
Announced: 2006-03-01
Affects: FreeBSD 5.3 and 5.4
Corrected: 2006-03-01 14:19:48 UTC (RELENG_5, 5.5-PRERELEASE)
2006-03-01 14:21:01 UTC (RELENG_5_4, 5.4-RELEASE-p12)
2006-03-01 14:24:52 UTC (RELENG_5_3, 5.3-RELEASE-p27)
CVE Name: CVE-2006-0883
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit
.
0. Revision History
v1.0 2006-03-01 Initial release.
v1.1 2006-03-01 Corrected workaround instructions.
v1.2 2006-03-03 Further correction to workaround.
I. Background
OpenSSH is an implementation of the SSH protocol suite, providing an
en
Debian
CVE-2006-0883: openssh - OpenSSH on FreeBSD 5.3 and 5.4, when used with OpenPAM, does not properly handle...
vendor_debian·2006·CVSS 5.0
CVE-2006-0883 [MEDIUM] CVE-2006-0883: openssh - OpenSSH on FreeBSD 5.3 and 5.4, when used with OpenPAM, does not properly handle...
OpenSSH on FreeBSD 5.3 and 5.4, when used with OpenPAM, does not properly handle when a forked child process terminates during PAM authentication, which allows remote attackers to cause a denial of service (client connection refusal) by connecting multiple times to the SSH server, waiting for the password prompt, then disconnecting.
Scope: local
bookworm: resolved (fixed in 1:3.8.1p1-4)
bullseye: resolved (fixed in 1:3.8.1p1-4)
forky: resolved (fixed in 1:3.8.1p1-4)
sid: resolved (fixed in 1:3.8.1p1-4)
trixie: resolved (fixed in 1:3.8.1p1-4)
Red Hat
CVE-2006-0883: OpenSSH on FreeBSD 5
vendor_redhat·CVSS 5.0
CVE-2006-0883 [MEDIUM] CVE-2006-0883: OpenSSH on FreeBSD 5
OpenSSH on FreeBSD 5.3 and 5.4, when used with OpenPAM, does not properly handle when a forked child process terminates during PAM authentication, which allows remote attackers to cause a denial of service (client connection refusal) by connecting multiple times to the SSH server, waiting for the password prompt, then disconnecting.
Statement: This issue did not affect the versions of OpenSSH as distributed with Red Hat Enterprise Linux 2.1, 3, or 4.
GHSA
GHSA-9x7m-vh7w-2mvh: OpenSSH on FreeBSD 5
ghsa_unreviewed·2022-05-03
CVE-2006-0883 [MEDIUM] GHSA-9x7m-vh7w-2mvh: OpenSSH on FreeBSD 5
OpenSSH on FreeBSD 5.3 and 5.4, when used with OpenPAM, does not properly handle when a forked child process terminates during PAM authentication, which allows remote attackers to cause a denial of service (client connection refusal) by connecting multiple times to the SSH server, waiting for the password prompt, then disconnecting.
OSV
CVE-2006-0883: OpenSSH on FreeBSD 5
osv·2006-03-07·CVSS 5.0
CVE-2006-0883 [MEDIUM] CVE-2006-0883: OpenSSH on FreeBSD 5
OpenSSH on FreeBSD 5.3 and 5.4, when used with OpenPAM, does not properly handle when a forked child process terminates during PAM authentication, which allows remote attackers to cause a denial of service (client connection refusal) by connecting multiple times to the SSH server, waiting for the password prompt, then disconnecting.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:09.openssh.aschttp://bugzilla.mindrot.org/show_bug.cgi?id=839http://securityreason.com/securityalert/520http://securitytracker.com/id?1015706http://www.osvdb.org/23797http://www.securityfocus.com/bid/16892http://www.vupen.com/english/advisories/2006/0805https://exchange.xforce.ibmcloud.com/vulnerabilities/25116ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:09.openssh.aschttp://bugzilla.mindrot.org/show_bug.cgi?id=839http://securityreason.com/securityalert/520http://securitytracker.com/id?1015706http://www.osvdb.org/23797http://www.securityfocus.com/bid/16892http://www.vupen.com/english/advisories/2006/0805https://exchange.xforce.ibmcloud.com/vulnerabilities/25116
2006-03-07
Published