A memory exhaustion issue in OpenSSH that can be triggered before user authentication was found. An unauthenticated attacker could consume approx. 400 MB of memory per each connection. The attacker could set up multiple such connections to run out of server’s memory. Affected versions: openssh-6.8p1, openssh-6.9p1, openssh-7.0p1, openssh-7.1p1, openssh-7.2p1, openssh-7.3p1. Upstream patch: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/kex.c?rev=1.127&content-type=text/x-cvsweb-markup
Acknowledgments: Name: Shi Lei (Qihoo 360)
Upstream patch: https://github.com/openssh/openssh-portable/commit/ec165c392ca54317dbe3064a8c200de6531e89ad
Analysis: It seems the only thing the attacker could do here, is self-dos his own connection. Regarding consuming memory on the server, by opening several concurrent connections at the same time, there are various protections available in opensshd_config file, such as "MaxStartups", which can limit the maximum number of sessions per network connections. Based on this we do not consider this to be a security issue. Statement: The Red Hat Product Security Team does not consider this issue to be a security flaw, for more information please refer to https://bugzilla.redhat.com/show_bug.cgi?id=1384860#c5
*** Bug 1384566 has been marked as a duplicate of this bug. ***
CVE request: http://seclists.org/oss-sec/2016/q4/185
*** Bug 1387116 has been marked as a duplicate of this bug. ***
CVE assignment: http://seclists.org/oss-sec/2016/q4/191