Vulnerability Description
Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecified vectors that lead to a double-free.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openbsd | Openssh | <= 4.4 |
| Debian | Debian Linux | 3.1 |
| Apple | Mac Os X | < 10.3.9 |
| Apple | Mac Os X Server | < 10.3.9 |
Related Weaknesses (CWE)
References
- ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:22.openssh.ascBroken Link
- ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.ascBroken Link
- http://docs.info.apple.com/article.html?artnum=305214Broken Link
- http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.htmlMailing List
- http://lists.freebsd.org/pipermail/freebsd-security/2006-October/004051.htmlMailing List
- http://marc.info/?l=openssh-unix-dev&m=115939141729160&w=2Mailing List
- http://openssh.org/txt/release-4.4Release Notes
- http://secunia.com/advisories/22158Broken LinkVendor Advisory
- http://secunia.com/advisories/22173Broken LinkVendor Advisory
- http://secunia.com/advisories/22183Broken LinkVendor Advisory
- http://secunia.com/advisories/22196Broken LinkVendor Advisory
- http://secunia.com/advisories/22208Broken LinkVendor Advisory
- http://secunia.com/advisories/22236Broken LinkVendor Advisory
- http://secunia.com/advisories/22245Broken LinkVendor Advisory
- http://secunia.com/advisories/22270Broken LinkVendor Advisory
FAQ
What is CVE-2006-5051?
CVE-2006-5051 is a vulnerability with a CVSS score of 8.1 (HIGH). Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecifi...
How severe is CVE-2006-5051?
CVE-2006-5051 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2006-5051?
Check the references section above for vendor advisories and patch information. Affected products include: Openbsd Openssh, Debian Debian Linux, Apple Mac Os X, Apple Mac Os X Server.