CVE-2024-6387

8.1High

Published 01 Jul 2024 · NVD status: Modified

8.1High

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-364, CWE-362

The AI triage for this one isn't ready yet. Check back in a few minutes; the full NVD record is below in the meantime.

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Ad · In-content banner

NVD description

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

References

https://access.redhat.com/errata/RHSA-2024:4312Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4340Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4389Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4469Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4474Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4479Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4484Third Party Advisory
https://access.redhat.com/security/cve/CVE-2024-6387Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2294604Third Party Advisory
https://santandersecurityresearch.github.io/blog/sshing_the_masses.htmlExploitThird Party Advisory
https://www.openssh.com/txt/release-9.8Release NotesThird Party Advisory
https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txtExploitThird Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/18Mailing List
http://seclists.org/fulldisclosure/2024/Jul/19Mailing List
http://seclists.org/fulldisclosure/2024/Jul/20Mailing List
http://www.openwall.com/lists/oss-security/2024/07/01/12Mailing List
http://www.openwall.com/lists/oss-security/2024/07/01/13Mailing List
http://www.openwall.com/lists/oss-security/2024/07/02/1Mailing List
http://www.openwall.com/lists/oss-security/2024/07/03/1Mailing List
http://www.openwall.com/lists/oss-security/2024/07/03/11ExploitMailing List
http://www.openwall.com/lists/oss-security/2024/07/03/2Mailing List
http://www.openwall.com/lists/oss-security/2024/07/03/3Mailing ListPatch
http://www.openwall.com/lists/oss-security/2024/07/03/4Mailing List
http://www.openwall.com/lists/oss-security/2024/07/03/5Mailing List
http://www.openwall.com/lists/oss-security/2024/07/04/1Mailing List

Source: nvd.nist.gov/vuln/detail/CVE-2024-6387