[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20161019213233.2E9CA52E00A@smtpvbsrv1.mitre.org>
Date: Wed, 19 Oct 2016 17:32:33 -0400 (EDT)
From: cve-assign@...re.org
To: shilei-c@....cn
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE Request: OpenSSH: Memory exhaustion issue found in OpenSSH
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
> The OpenSSH has a memory exhaustion bug in key exchange process. An
> unauthenticated peer could repeat the KEXINIT and cause allocation of
> up to 384MB(not 128MB that the official said). In the default case, an
> attacker can build 100 such connections, which will consume 38400 MB
> of memory on the server.
> http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/kex.c?rev=1.127&content-type=text/x-cvsweb-markup
>> Unregister the KEXINIT handler after message has been received.
Use CVE-2016-8858.
- --
CVE Assignment Team
M/S M300, 202 Burlington Road, Bedford, MA 01730 USA
[ A PGP key is available for encrypted communications at
http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJYB+W7AAoJEHb/MwWLVhi2PK0QALEeBA+iTzAL1ZrgIoiDJsYm
xvsg61m19gz/Wf9sxXLPDd13lhRJhEIs/fBfdngIBaXRTi5dYI7HAsVGB2gnWMsj
fqUZSfmcYri2VunzYWOX8J81OtBxUR670SOA757g7ktd+6MEq2QQNb1vJSOprapU
1MqZkz9ZD/c/22pAC/SNCIeT4mZpCNxHZwVCPrELIKKnsp9cYQf0xvRBYFnxulre
RplzO2iq6GDOk4etpA0YyOzOGA6iZt9+O13+ROaILYUIwUF7DseQKNpB2F82An6l
qCXYE7d0ZMHDRyPZPmKf72VVM92N+KDoRG/8LlFcn4Yso2o7gHmv5UCRUuFVjD15
3ZDwYbCB+qtYQ5aLm561Jp1+2rTGg+p1G3bvjRAILp4ZFdsyzDgS02r1epg9TBfx
GU9QN0GJyjNHFR16KJgo5JtPU0lHk+g68JtsmHzXRZemsQ53ujUK/4gv9lB1feuA
Nw0ABpuznYOgxN/FuEi1k7SasAZH1KRSiUV/UIiAWLayXE/6q9MMYWhzGPjk317c
dX+ceeov1GfjsZOfnqiK8bzZfrfPm0qBhOZ1mAJsOiSdQjU4nzYJVewTmflrNLnR
a+0MHCdOp0uOVoG3jLUOc50mRePLscv80DiiuX31ukO1SacGGNEMyAE/N4eqHd57
ByjtYBRhe+CxotowFPtd
=Op5b
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
