CVE-2006-4924

Published: Sep 27, 2006Modified: Apr 23, 2026

7.8

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability: 10.0 / Impact: 6.9

Source: NVD

Description

sshd in OpenSSH before 4.4, when using the version 1 SSH protocol, allows remote attackers to cause a denial of service (CPU consumption) via an SSH packet that contains duplicate blocks, which is not properly handled by the CRC compensation attack detector.

Affected (56)

Products: Openbsd: Openssh

Openbsd

1 product

Openssh

Configuration A

56 vulnerable

Vulnerable Software	Affected Versions
Openbsd Openssh	Version 1.2.1
Openbsd Openssh	Version 1.2.27
Openbsd Openssh	Version 1.2.2
Openbsd Openssh	Version 1.2.3
Openbsd Openssh	Version 1.2
Openbsd Openssh	Version 2.1.1
Openbsd Openssh	Version 2.1
Openbsd Openssh	Version 2.2
Openbsd Openssh	Version 2.3
Openbsd Openssh	Version 2.5.1
Openbsd Openssh	Version 2.5.2
Openbsd Openssh	Version 2.5
Openbsd Openssh	Version 2.9.9
Openbsd Openssh	Version 2.9.9p2
Openbsd Openssh	Version 2.9
Openbsd Openssh	Version 2.9p1
Openbsd Openssh	Version 2.9p2
Openbsd Openssh	Version 3.0.1
Openbsd Openssh	Version 3.0.1p1
Openbsd Openssh	Version 3.0.2
Openbsd Openssh	Version 3.0.2p1
Openbsd Openssh	Version 3.0
Openbsd Openssh	Version 3.0p1
Openbsd Openssh	Version 3.1
Openbsd Openssh	Version 3.1p1
Openbsd Openssh	Version 3.2.2
Openbsd Openssh	Version 3.2.2p1
Openbsd Openssh	Version 3.2.3p1
Openbsd Openssh	Version 3.2
Openbsd Openssh	Version 3.3
Openbsd Openssh	Version 3.3p1
Openbsd Openssh	Version 3.4
Openbsd Openssh	Version 3.4p1
Openbsd Openssh	Version 3.5
Openbsd Openssh	Version 3.5p1
Openbsd Openssh	Version 3.6.1
Openbsd Openssh	Version 3.6.1p1
Openbsd Openssh	Version 3.6.1p2
Openbsd Openssh	Version 3.6
Openbsd Openssh	Version 3.7.1
Openbsd Openssh	Version 3.7.1p1
Openbsd Openssh	Version 3.7.1p2
Openbsd Openssh	Version 3.7
Openbsd Openssh	Version 3.8.1
Openbsd Openssh	Version 3.8.1p1
Openbsd Openssh	Version 3.8
Openbsd Openssh	Version 3.9.1
Openbsd Openssh	Version 3.9.1p1
Openbsd Openssh	Version 3.9
Openbsd Openssh	Version 4.0
Openbsd Openssh	Version 4.0p1
Openbsd Openssh	Version 4.1p1
Openbsd Openssh	Version 4.2
Openbsd Openssh	Version 4.2p1
Openbsd Openssh	Version 4.3
Openbsd Openssh	Version 4.3p1

Related CWEs

CWE-399

References (158)

ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:22.openssh.asc (unsafe URL)

Source: secalert@redhat.com

ftp://ftp.sco.com/pub/unixware7/714/security/p534336/p534336.txt (unsafe URL)

Source: secalert@redhat.com

ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc (unsafe URL)

Source: secalert@redhat.com

http://blogs.sun.com/security/entry/sun_alert_102962_security_vulnerability

Source: secalert@redhat.com

http://bugs.gentoo.org/show_bug.cgi?id=148228

Source: secalert@redhat.com

http://docs.info.apple.com/article.html?artnum=305214

Source: secalert@redhat.com

http://itrc.hp.com/service/cki/docDisplay.do?docId=c00815112

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html

Source: secalert@redhat.com

http://marc.info/?l=openssh-unix-dev&m=115939141729160&w=2

Source: secalert@redhat.com

http://secunia.com/advisories/21923

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22091

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22116

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22158

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22164

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22183

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22196

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22208

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22236

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22245

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22270

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22298

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22352

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22362

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22487

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22495

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22823

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22926

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/23038

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/23241

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/23340

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/23680

Source: secalert@redhat.com

http://secunia.com/advisories/24479

Source: secalert@redhat.com

http://secunia.com/advisories/24799

Source: secalert@redhat.com

http://secunia.com/advisories/24805

Source: secalert@redhat.com

http://secunia.com/advisories/25608

Source: secalert@redhat.com

http://secunia.com/advisories/29371

Source: secalert@redhat.com

http://secunia.com/advisories/34274

Source: secalert@redhat.com

http://security.freebsd.org/advisories/FreeBSD-SA-06%3A22.openssh.asc

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-200609-17.xml

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-200611-06.xml

Source: secalert@redhat.com

http://securitytracker.com/id?1016931

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.592566

Source: secalert@redhat.com

http://sourceforge.net/forum/forum.php?forum_id=681763

Source: secalert@redhat.com

http://sourceforge.net/project/shownotes.php?release_id=461863&group_id=69227

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102962-1

Source: secalert@redhat.com

http://support.avaya.com/elmodocs2/security/ASA-2006-216.htm

Source: secalert@redhat.com

http://support.avaya.com/elmodocs2/security/ASA-2006-262.htm

Source: secalert@redhat.com

http://www-unix.globus.org/mail_archive/security-announce/2007/04/msg00000.html

Source: secalert@redhat.com

http://www.debian.org/security/2006/dsa-1189

Source: secalert@redhat.com

Patch

http://www.debian.org/security/2006/dsa-1212

Source: secalert@redhat.com

Patch

http://www.kb.cert.org/vuls/id/787448

Source: secalert@redhat.com

US Government Resource

http://www.mandriva.com/security/advisories?name=MDKSA-2006:179

Source: secalert@redhat.com

http://www.novell.com/linux/security/advisories/2006_24_sr.html

Source: secalert@redhat.com

http://www.novell.com/linux/security/advisories/2006_62_openssh.html

Source: secalert@redhat.com

http://www.openbsd.org/errata.html#ssh

Source: secalert@redhat.com

http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.022-openssh.html

Source: secalert@redhat.com

http://www.osvdb.org/29152

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2006-0697.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2006-0698.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/447153/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/20216

Source: secalert@redhat.com

ExploitPatch

http://www.trustix.org/errata/2006/0054

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-355-1

Source: secalert@redhat.com

http://www.us-cert.gov/cas/techalerts/TA07-072A.html

Source: secalert@redhat.com

US Government Resource

http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html

Source: secalert@redhat.com

http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2006/3777

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2006/4401

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2006/4869

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/0930

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/1332

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/2119

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/0740

Source: secalert@redhat.com

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=207955

Source: secalert@redhat.com

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/29158

Source: secalert@redhat.com

https://hypersonic.bluecoat.com/support/securityadvisories/ssh_server_on_sg

Source: secalert@redhat.com

https://issues.rpath.com/browse/RPL-661

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10462

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1193

Source: secalert@redhat.com

ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:22.openssh.asc (unsafe URL)