OpenSSH Out of Order NEWKEYS Messages Denial of Service Vulnerability
Summary
DLA-1257-1: openssh - security update. Affects openssh versions < 1:6.0p1-4+deb7u7. Fixed in 1:6.0p1-4+deb7u7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is an open-source implementation of the SSH protocol suite, providing secure remote access and file transfer capabilities. It is widely used in Linux and Unix-like systems for secure communication between networked devices. The vulnerability in question affects OpenSSH version 6.0p1-4+deb7u7 on Debian 7 Wheezy.
Vulnerability Detail
The vulnerability in OpenSSH allows for out of order NEWKEYS messages, which can cause the daemon to crash, resulting in a denial of service attack. An attacker can exploit this vulnerability by sending specially crafted packets to the target system, causing the SSH daemon to become unresponsive and potentially disrupting legitimate user access.
How To Fix
Minimum fixed version
1:6.0p1-4+deb7u7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update as soon as possible to mitigate the risk of a denial of service attack.
Conclusion
OpenSSH version 6.0p1-4+deb7u7 on Debian 7 Wheezy is vulnerable to a denial of service attack due to out of order NEWKEYS messages. It is crucial to upgrade the openssh package to the recommended version to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for openssh →
FAQ
OpenSSH is an open-source implementation of the SSH protocol suite, providing secure remote access and file transfer capabilities.
The vulnerability affects OpenSSH version 6.0p1-4+deb7u7 on Debian 7 Wheezy.
An attacker can exploit this vulnerability by sending specially crafted packets to the target system, causing the SSH daemon to crash and result in a denial of service attack.
There is no known workaround for this vulnerability. It is crucial to apply the security update to mitigate the risk.
To fix this vulnerability, you need to upgrade the openssh package to version 1:6.0p1-4+deb7u7 or later. Follow the recommended update procedure for your Debian 7 Wheezy system.
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
