Description
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- almalinux / almalinux9.0 – 9.0
- Amazon / amazon_linux2023.0 – 2023.0
- Apple / macOS12.0 – 12.7.6
- Arista / eos4.32.0 – 4.32.1f
- Canonical / Ubuntu Linux22.10 – 22.10
- Canonical / Ubuntu Linux22.04 – 22.04
- Canonical / Ubuntu Linux24.04 – 24.04
- Canonical / Ubuntu Linux23.10 – 23.10
- Canonical / Ubuntu Linux23.04 – 23.04
- Debian / debian_linux12.0 – 12.0
- FreeBSD / FreeBSD14.0 – 14.0
- FreeBSD / FreeBSD14.0 – 14.0
- FreeBSD / FreeBSD14.0 – 14.0
- FreeBSD / FreeBSD14.0 – 14.0
- FreeBSD / FreeBSD13.3 – 13.3
- FreeBSD / FreeBSD13.3 – 13.3
- FreeBSD / FreeBSD13.3 – 13.3
- FreeBSD / FreeBSD13.3 – 13.3
- FreeBSD / FreeBSD13.2 – 13.2
- FreeBSD / FreeBSD13.2 – 13.2
- FreeBSD / FreeBSD13.2 – 13.2
- FreeBSD / FreeBSD13.2 – 13.2
- FreeBSD / FreeBSD13.2 – 13.2
- FreeBSD / FreeBSD13.2 – 13.2
- FreeBSD / FreeBSD13.2 – 13.2
- FreeBSD / FreeBSD13.2 – 13.2
- FreeBSD / FreeBSD13.2 – 13.2
- FreeBSD / FreeBSD13.2 – 13.2
- FreeBSD / FreeBSD13.2 – 13.2
- FreeBSD / FreeBSD13.2 – 13.2
- FreeBSD / FreeBSD14.1 – 14.1
- FreeBSD / FreeBSD14.1 – 14.1
- FreeBSD / FreeBSD14.0 – 14.0
- FreeBSD / FreeBSD14.0 – 14.0
- FreeBSD / FreeBSD14.0 – 14.0
- FreeBSD / FreeBSD14.0 – 14.0
- FreeBSD / FreeBSD14.0 – 14.0
- FreeBSD / FreeBSD14.0 – 14.0
- FreeBSD / FreeBSD14.0 – 14.0
- NetApp / 500f_firmware
- NetApp / 8300_firmware
- NetApp / 8700_firmware
- NetApp / a150_firmware
- NetApp / a1k_firmware
- NetApp / a220_firmware
- NetApp / a250_firmware
- NetApp / a400_firmware
- NetApp / a700s_firmware
- NetApp / a70_firmware
- NetApp / a800_firmware
- NetApp / a900_firmware
- NetApp / a90_firmware
- NetApp / a9500_firmware
- NetApp / active_iq_unified_manager
- NetApp / bootstrap_os
- NetApp / c190_firmware
- NetApp / c250_firmware
- NetApp / c400_firmware
- NetApp / c800_firmware
- NetApp / e-series_santricity_os_controller11.0.0 – 11.70.2
- NetApp / fas2720_firmware
- NetApp / fas2750_firmware
- NetApp / fas2820_firmware
- NetApp / ontap9 – 9
- NetApp / ONTAP Select Deploy administration utility
- NetApp / ontap_tools10 – 10
- NetApp / ontap_tools9 – 9
- NetBSD / netbsd10.0.0
- OpenBSD / OpenSSH8.6 – 8.6
- OpenBSD / OpenSSH4.4 – 4.4
- OpenBSD / OpenSSH8.5 – 8.5
- OpenBSD / OpenSSH4.4
- RedHat / enterprise_linux9.0 – 9.0
- RedHat / enterprise_linux_eus9.4 – 9.4
- RedHat / enterprise_linux_for_arm_649.0_aarch64 – 9.0_aarch64
- RedHat / enterprise_linux_for_arm_64_eus9.4_aarch64 – 9.4_aarch64
- RedHat / enterprise_linux_for_ibm_z_systems9.0_s390x – 9.0_s390x
- RedHat / enterprise_linux_for_ibm_z_systems_eus9.4_s390x – 9.4_s390x
- RedHat / enterprise_linux_for_power_little_endian9.0_ppc64le – 9.0_ppc64le
- RedHat / enterprise_linux_for_power_little_endian_eus9.4_ppc64le – 9.4_ppc64le
- RedHat / enterprise_linux_server_aus9.4 – 9.4
- RedHat / openshift_container_platform4.0 – 4.0
- SonicWall / sma_6200_firmware
- SonicWall / sma_6210_firmware
- SonicWall / sma_7200_firmware
- SonicWall / sma_7210_firmware
- SonicWall / sma_8200v_firmware
- SonicWall / sra_ex_7000_firmware
- SUSE / linux_enterprise_micro6.0 – 6.0
Exploits & proofs of concept
- exploit-dbOpenSSH server (sshd) 9.8p1 - Race Conditionby Milad karimi
References
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:4312
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:4340
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:4389
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:4469
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:4474
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:4479
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:4484
- VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2024-6387
- MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2294604
- MISChttps://santandersecurityresearch.github.io/blog/sshing_the_masses.html
- MISChttps://www.openssh.com/txt/release-9.8
- MISChttps://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
Updated 7m ago · 8 sources