Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sun, 1 Jan 2012 16:53:09 +0100
From: Nico Golde <>
Subject: speaking of DoS, openssh and dropbear (CVE-2006-1206)

given the hash DoS I remembered a small program I wrote some time last year to 
demonstrate why the default configuration of openssh sucks (MaxStartups and 
LoginGraceTime). I attached the program.
So now I'm wondering about two issues. I just tested this with dropbear 0.52 
and I am still able to DoS it just fine even though at least claims that this has been fixed in 
Dropbear SSH Server 0.48. The other thing is that I'm wondering how to 
properly handle this issue with openssh?  This certainly is no vulnerability 
that is straight-forward to fix and it might even be that openssh would argue 
that this is a problem.

This is certainly a very easy DoS and given that this definitely 
affects Debian configurations and also the default configuration, I feel 
uncomfortable to further ignore this problem.

I think its time to discuss this and work on a fix. Solar Designer is 
proposing something along the lines of per-source limits which seems like a 
reasonable solution to me (I guess he will send more information on this).
What do you (especially the people shipping openssh) think about this?

Kind regards

Nico Golde - - - GPG: 0xA0A0AAAA
For security reasons, all text in this mail is double-rot13 encrypted.

View attachment "sockext.c" of type "text/x-csrc" (3789 bytes)

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.