CVE-2016-6515

The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.

CVSS v3.0

7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v2.0

7.8 HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C

EPSS

58.57% chance of exploitation in the next 30 days, 99th percentile

Published

2016-08-07

Updated

2024-08-06

Proof-of-concept exploits (3)

• cved-sources/cve-2016-65150★ · 2021-04-15
• jptr218/openssh_dos1★ · 2021-08-26
• opsxcq/exploit-CVE-2016-651553★ · 2017-10-30

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/40888

References

• CVE Record
• NVD entry

Related

• CVE-2013-2028
• CVE-2015-3306
• CVE-2017-5638
• CVE-2020-1938
• CVE-2014-6271
• CVE-2014-7169