Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 542
Alerts This Week
Warning Icon 1 542

Ubuntu 16.04 USN-3061-1: OpenSSH Authenticator DoS Issues

ubuntu
Calendar Grey August 15, 2016
Scroller Ubuntu
Debian addresses crucial OpenSSH issues affecting user logins and potential service disruptions. Ensure your systems are updated immediately!
Several security issues were fixed in OpenSSH.

Summary

Several security issues were fixed in OpenSSH.

Software Description:

- openssh: secure shell (SSH) for secure access to remote machines

Details:

Eddie Harari discovered that OpenSSH incorrectly handled password hashing

when authenticating non-existing users. A remote attacker could perform a

timing attack and enumerate valid users. (CVE-2016-6210)

Tomas Kuthan, Andres Rojas, and Javier Nieto discovered that OpenSSH did

not limit password lengths. A remote attacker could use this issue to cause

OpenSSH to consume resources, leading to a denial of service.

(CVE-2016-6515)

Topics%20covered

Topics Covered

security advisory denial of service Ubuntu authentication issue OpenSSH

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  openssh-server                  1:7.2p2-4ubuntu2.1

Ubuntu 14.04 LTS:
  openssh-server                  1:6.6p1-2ubuntu2.8

Ubuntu 12.04 LTS:
  openssh-server                  1:5.9p1-5ubuntu1.10

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-3061-1

CVE-2016-6210, CVE-2016-6515

Severity
important
Lowest
Low
Medium
High
Critical

August 15, 2016

Topics%20covered

Topics Covered

security advisory denial of service Ubuntu authentication issue OpenSSH

Package Information

https://launchpad.net/ubuntu/+source/openssh/1:7.2p2-4ubuntu2.1
https://launchpad.net/ubuntu/+source/openssh/1:6.6p1-2ubuntu2.8
https://launchpad.net/ubuntu/+source/openssh/1:5.9p1-5ubuntu1.10

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.