Vulnerability Note VU#787448

OpenSSH fails to properly handle multiple identical blocks in a SSH packet

Original Release date: 04 Oct 2006 | Last revised: 13 Mar 2007


OpenSSH fails to properly handle multiple identical blocks in a SSH packet. This vulnerability may cause a denial-of-service condition.


OpenSSH is an open source client and server implementation of the Secure Shell (SSH) protocol. OpenSSH includes a cyclic redundancy check (CRC) compensation attack detection function that produces a checksum on a block of data in a SSH packet. This function was introduced to defend against exploitation of CRC weaknesses in version 1 of the SSH protocol (see VU#13877). Multiple identical blocks contained within a SSH packet may trigger a computationally expensive operation within the CRC attack detector that can lead to a denial of service. According to the OpenSSH 4.4 release notes:

[This vulnerability]...would cause sshd(8) to spin until the login grace time expired.
The OpenSSH sshd daemon is only vulnerable when SSH protocol version 1 is enabled.


A remote, unauthenticated attacker could cause a denial-of service condition by sending specially crafted packets to the OpenSSH server that would cause it to use excessive CPU time until a connection timeout occurs.


See the systems affected section of this document for information about specific vendors. Users who compile OpenSSH from source are encouraged to update to the most recent version.

Disable SSH version 1

SSH protocol version 1 should be disabled in order to prevent this vulnerability from occurring on affected systems.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Apple Computer, Inc.Affected-13 Mar 2007
Avaya, Inc.Affected-23 Oct 2006
Debian GNU/LinuxAffected-06 Oct 2006
FreeBSD, Inc.Affected-04 Oct 2006
Gentoo LinuxAffected-02 Oct 2006
Hewlett-Packard CompanyAffected-19 Jan 2007
Mandriva, Inc.Affected-06 Oct 2006
OpenBSDAffected-10 Nov 2006
OpenPKGAffected-04 Oct 2006
OpenSSHAffected-02 Oct 2006
Red Hat, Inc.Affected-02 Oct 2006
rPathAffected-02 Oct 2006
Slackware Linux Inc.Affected-02 Oct 2006
SUSE LinuxAffected-23 Oct 2006
Trustix Secure LinuxAffected-06 Oct 2006
If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A



This issue was reported in the OpenSSH 4.4 release notes . OpenSSH credits Tavis Ormandy of the Google Security Team for reporting this issue.

This document was written by Chris Taschner.

Other Information

  • CVE IDs: CVE-2006-4924
  • Date Public: 27 Sep 2006
  • Date First Published: 04 Oct 2006
  • Date Last Updated: 13 Mar 2007
  • Severity Metric: 8.82
  • Document Revision: 41


If you have feedback, comments, or additional information about this vulnerability, please send us email.