CVE-2015-5600

Vulnerability

The vulnerability resides in the kbdint_next_device function in auth2-chall.c of sshd. OpenSSH through version 6.9 does not properly restrict the processing of keyboard-interactive devices, allowing a client to specify a duplicative list of devices (e.g., pam,pam,...). This flaw enables bypassing the MaxAuthTries limit and can be triggered by using the -oKbdInteractiveDevices option with many repeated entries [1][3].

Exploitation

An attacker with network access to an SSH server can use a modified client to send an excessive list of keyboard-interactive devices. Each device triggers a separate authentication attempt, allowing numerous password guesses within a single connection without being limited by MaxAuthTries. For example, running ssh -l user -oKbdInteractiveDevices=$(perl -e 'print "pam," x 10000') target and then entering different passwords for each prompt [4]. This can also cause high CPU consumption on the server, leading to denial of service [1].

Impact

Successful exploitation allows an attacker to perform brute-force password guessing attacks far more efficiently, bypassing the configured maximum authentication attempts. This increases the likelihood of guessing a valid password. Additionally, the attack can cause significant CPU resource exhaustion, resulting in a denial of service condition [1][4].

Mitigation

The vulnerability is fixed in OpenSSH 7.0 (released August 11, 2015) and later versions [3]. Red Hat Enterprise Linux 6 received a backported fix in RHSA-2016-0466 [1]. Arista EOS fixed it in releases 4.12.11M, 4.13.13M, 4.14.10M, and 4.15.2F [4]. Users unable to upgrade should restrict SSH access to trusted networks and enforce strong password policies [4].