Denial of Service Vulnerability in OpenSSH by Remote Authenticated Users
CVE-2010-4755

Currently unrated

Key Information:

Vendor
OpenBSD
Status
Openssh
FreeBSD
Netbsd
OpenBSD
Vendor
CVE Published:
2 March 2011

Summary

The remote_glob function in sftp-glob.c and the process_put function in sftp.c, found in versions of OpenSSH earlier than 5.9, enable remote authenticated users to exploit crafted glob expressions, resulting in significant CPU and memory consumption. When these expressions do not match existing pathnames, they create a denial of service condition, impacting system performance and availability. This vulnerability affects several operating systems, including FreeBSD, NetBSD, and OpenBSD.

References

http://cvsweb.netbsd.org/cgi-bin/cvsweb.cgi/src/crypto/di...
x_refsource_CONFIRM
http://securityreason.com/achievement_securityalert/89
third-party-advisoryx_refsource_SREASONRES
http://securityreason.com/exploitalert/9223
x_refsource_MISC

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.