CVE-2016-6515

Published: Aug 7, 2016Modified: May 6, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.

Affected (2)

Products: Openbsd: Openssh · Fedoraproject: Fedora

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openbsd Openssh	Up to 7.2

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 24

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (30)

http://openwall.com/lists/oss-security/2016/08/01/2

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/140070/OpenSSH-7.2-Denial-Of-Service.html

Source: cve@mitre.org

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/92212

Source: cve@mitre.org

http://www.securitytracker.com/id/1036487

Source: cve@mitre.org

https://access.redhat.com/errata/RHSA-2017:2029

Source: cve@mitre.org

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Source: cve@mitre.org

https://cert-portal.siemens.com/productcert/pdf/ssa-676336.pdf

Source: cve@mitre.org

https://github.com/openssh/openssh-portable/commit/fcd135c9df440bcd2d5870405ad3311743d78d97

Source: cve@mitre.org

Issue TrackingPatch

https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X2L6RW34VFNXYNVVN2CN73YAGJ5VMTFU/

Source: cve@mitre.org

https://security.FreeBSD.org/advisories/FreeBSD-SA-17:06.openssh.asc

Source: cve@mitre.org

https://security.netapp.com/advisory/ntap-20171130-0003/

Source: cve@mitre.org

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03779en_us

Source: cve@mitre.org

https://www.exploit-db.com/exploits/40888/

Source: cve@mitre.org

http://openwall.com/lists/oss-security/2016/08/01/2