Bug 938746 (CVE-2015-5600) - VUL-0: CVE-2015-5600: openssh: Keyboard-interactive authentication brute force vulnerability
Summary: VUL-0: CVE-2015-5600: openssh: Keyboard-interactive authentication brute forc...
Status: RESOLVED FIXED
: 951769 986650 (view as bug list)
Alias: CVE-2015-5600
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Deadline: 2017-01-18
Assignee: Petr Cerny
QA Contact: Security Team bot
URL:
Whiteboard: maint:running:62212:moderate CVSSv2:N...
Keywords:
Depends on:
Blocks:
 
Reported: 2015-07-20 12:26 UTC by Johannes Segitz
Modified: 2019-06-16 14:38 UTC (History)
16 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
Upstream patch (1.32 KB, patch)
2015-07-23 07:25 UTC, Johannes Segitz
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2015-07-20 12:26:19 UTC
https://kingcope.wordpress.com/2015/07/16/openssh-keyboard-interactive-authentication-brute-force-vulnerability-maxauthtries-bypass/

"With this vulnerability an attacker is able to request as many password prompts limited by the “login graced time” setting, that is set to two minutes by default."
Comment 2 Swamp Workflow Management 2015-07-20 22:00:45 UTC
bugbot adjusting priority
Comment 4 Johannes Segitz 2015-07-23 07:24:55 UTC
CVE-2015-5600 was assigned
Comment 5 Johannes Segitz 2015-07-23 07:25:36 UTC
Created attachment 641785 [details]
Upstream patch
Comment 7 Marcus Meissner 2015-07-25 07:59:38 UTC
REPRODUCER:

ssh -ltux -oKbdInteractiveDevices=`perl -e 'print "pam," x 10000'` localhost

should not allow more than around 3 password entries.
Comment 13 Andreas Stieger 2015-09-07 09:05:37 UTC
Adjusting severity
Comment 20 Swamp Workflow Management 2015-09-11 13:10:34 UTC
SUSE-SU-2015:1544-1: An update that solves 5 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 903649,932483,936695,938746,943006,943010
CVE References: CVE-2015-4000,CVE-2015-5352,CVE-2015-5600,CVE-2015-6563,CVE-2015-6564
Sources used:
SUSE Linux Enterprise Server 12 (src):    openssh-6.6p1-29.1, openssh-askpass-gnome-6.6p1-29.1
SUSE Linux Enterprise Desktop 12 (src):    openssh-6.6p1-29.1, openssh-askpass-gnome-6.6p1-29.1
Comment 21 Swamp Workflow Management 2015-09-11 15:12:41 UTC
SUSE-SU-2015:1547-1: An update that solves 5 vulnerabilities and has 5 fixes is now available.

Category: security (moderate)
Bug References: 673532,903649,905118,914309,916549,932483,936695,938746,943006,943010
CVE References: CVE-2015-4000,CVE-2015-5352,CVE-2015-5600,CVE-2015-6563,CVE-2015-6564
Sources used:
SUSE Linux Enterprise Server for VMWare 11-SP3 (src):    openssh-6.2p2-0.17.1, openssh-askpass-gnome-6.2p2-0.17.3
SUSE Linux Enterprise Server 11-SP3 (src):    openssh-6.2p2-0.17.1, openssh-askpass-gnome-6.2p2-0.17.3
Comment 22 Swamp Workflow Management 2015-09-11 16:12:54 UTC
SUSE-SU-2015:1547-2: An update that solves 5 vulnerabilities and has 5 fixes is now available.

Category: security (moderate)
Bug References: 673532,903649,905118,914309,916549,932483,936695,938746,943006,943010
CVE References: CVE-2015-4000,CVE-2015-5352,CVE-2015-5600,CVE-2015-6563,CVE-2015-6564
Sources used:
SUSE Linux Enterprise Desktop 11-SP3 (src):    openssh-6.2p2-0.17.1, openssh-askpass-gnome-6.2p2-0.17.3
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    openssh-6.2p2-0.17.1, openssh-askpass-gnome-6.2p2-0.17.3
Comment 24 Swamp Workflow Management 2015-09-21 07:12:58 UTC
SUSE-SU-2015:1581-1: An update that solves 5 vulnerabilities and has 6 fixes is now available.

Category: security (important)
Bug References: 673532,903649,905118,914309,916549,932483,936695,938746,943006,943010,945493
CVE References: CVE-2015-4000,CVE-2015-5352,CVE-2015-5600,CVE-2015-6563,CVE-2015-6564
Sources used:
SUSE Linux Enterprise Server for VMWare 11-SP3 (src):    openssh-6.2p2-0.21.1, openssh-askpass-gnome-6.2p2-0.21.3
SUSE Linux Enterprise Server 11-SP3 (src):    openssh-6.2p2-0.21.1, openssh-askpass-gnome-6.2p2-0.21.3
SUSE Linux Enterprise Desktop 11-SP3 (src):    openssh-6.2p2-0.21.1, openssh-askpass-gnome-6.2p2-0.21.3
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    openssh-6.2p2-0.21.1, openssh-askpass-gnome-6.2p2-0.21.3
Comment 25 Haral Tsitsivas 2015-10-02 00:29:56 UTC
Requesting a SLES11 SP1 LTSS patch for this.
Comment 26 Johannes Segitz 2015-10-02 07:01:38 UTC
(In reply to Haral Tsitsivas from comment #25)
This doesn't qualify for a LTSS update, sorry
Comment 27 Marcus Meissner 2015-10-02 07:37:00 UTC
If you have a valid LTSS contract for the SLES11 SP1 LTSS codestream, request a PTF please via your regular support contact.
Comment 30 Swamp Workflow Management 2015-10-07 14:55:04 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2015-10-21.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/62308
Comment 31 Swamp Workflow Management 2015-10-07 16:12:00 UTC
SUSE-SU-2015:1695-1: An update that solves 5 vulnerabilities and has 5 fixes is now available.

Category: security (moderate)
Bug References: 903649,932483,936695,938746,939932,943006,943010,945484,945493,947458
CVE References: CVE-2015-4000,CVE-2015-5352,CVE-2015-5600,CVE-2015-6563,CVE-2015-6564
Sources used:
SUSE Linux Enterprise Server 11-SP4 (src):    openssh-6.6p1-13.1, openssh-askpass-gnome-6.6p1-13.3
SUSE Linux Enterprise Desktop 11-SP4 (src):    openssh-6.6p1-13.1, openssh-askpass-gnome-6.6p1-13.3
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    openssh-6.6p1-13.1, openssh-askpass-gnome-6.6p1-13.3
Comment 34 Swamp Workflow Management 2015-10-28 16:11:31 UTC
SUSE-SU-2015:1840-1: An update that solves three vulnerabilities and has four fixes is now available.

Category: security (moderate)
Bug References: 673532,903649,905118,914309,932483,936695,938746
CVE References: CVE-2015-4000,CVE-2015-5352,CVE-2015-5600
Sources used:
SUSE Linux Enterprise Server 11-SP2-LTSS (src):    openssh-5.1p1-41.69.1, openssh-askpass-gnome-5.1p1-41.69.4
Comment 35 Greg Searle 2015-11-09 15:05:14 UTC
I have a customer that is a LTSS contract customer and is requesting this fix get ported back to SLES 10 SP4.

Should I use this same defect or do I need to create another one?

please advise.

Greg
Comment 37 Josef Cejka 2015-12-17 09:47:10 UTC
*** Bug 951769 has been marked as a duplicate of this bug. ***
Comment 38 Josef Cejka 2016-01-12 07:57:30 UTC
*** Bug 959298 has been marked as a duplicate of this bug. ***
Comment 39 Sebastian Krahmer 2016-02-15 13:52:50 UTC
*** Bug 966692 has been marked as a duplicate of this bug. ***
Comment 41 Andreas Stieger 2016-05-12 14:11:11 UTC
A maintenance update for Leap 42.1 was imported, a separate update for 13.2 was requested, we do not seem to have shipped it.
Comment 42 Bernhard Wiedemann 2016-05-27 10:01:22 UTC
This is an autogenerated message for OBS integration:
This bug (938746) was mentioned in
https://build.opensuse.org/request/show/398334 13.2 / openssh
Comment 43 Josef Cejka 2016-07-04 13:00:08 UTC
*** Bug 986650 has been marked as a duplicate of this bug. ***
Comment 44 Forgotten User MuQ5q_YN48 2016-08-12 09:48:06 UTC
Is a fix package for openSUSE 13.2 still planned?
The request (https://build.opensuse.org/request/show/398334) seems to be declined...
Comment 45 Swamp Workflow Management 2017-01-11 10:24:28 UTC
An update workflow for this issue was started.
This issue was rated as important.
Please submit fixed packages until 2017-01-18.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/63340
Comment 46 Forgotten User 1WDpXuZZ09 2017-02-21 18:58:32 UTC
Any update on OpenSUSE 13.2 patch for this? Current openssh version is 6.6p1-5.3.1, and it has the vulnerability. Or can someone refer me to a patch that works with the given version?
Comment 47 Marcus Meissner 2017-02-21 21:44:26 UTC
a 13.2 update is not planned anymore. opensuse 13.2 reached EOL in January
Comment 48 Marcus Meissner 2017-02-22 08:38:29 UTC
I am sorry we did not keep look out for a new 13.2 submission :(
Comment 49 Forgotten User 1WDpXuZZ09 2017-02-22 18:07:41 UTC
That's cool! I found 7.2p1 here,
https://software.opensuse.org/download.html?project=network&package=openssh (Just in case anyone stumbles upon this thread)