Re: [Full-disclosure] Possible DOS issue in OpenSSH ssh client

[Paul Schmehl <pauls@xxxxxxxxxxxx>]

Espen Grøndahl wrote:
> During some testing I found a possible bug/issue with OpenSSH ssh client.
>
> MachineA # cat < /dev/zero | nc –l –p 3000
>
> MachineB# ssh someone@MachineA –p 3000
>
> I have tested on OpenBSD 3.9, CentOS 4.3, Debian 3.1 and Solaris 9.
>
> This consumes 50-100% of available CPU time on MachineB ( depending on the
> bandwith between them ).
What did the ssh client do?  Did it eventually time out (as you would 
expect)?  Or did it hang and never disconnect?

--
Paul Schmehl (pauls@xxxxxxxxxxxx)
Adjunct Information Security Officer
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/