{"id":"CVE-2008-4109","published":"2008-09-17T18:06:00Z","modified":"2024-08-07T10:00:42Z","title":"A certain Debian patch for OpenSSH before 4.3p2-9etch3 on etch; before 4.6p1-1 on sid and lenny; and on other…","vendor":null,"product":null,"tier":"tail","description":{"text":"A certain Debian patch for OpenSSH before 4.3p2-9etch3 on etch; before 4.6p1-1 on sid and lenny; and on other distributions such as SUSE uses functions that are not async-signal-safe in the signal handler for login timeouts, which allows remote attackers to cause a denial of service (connection slot exhaustion) via multiple login attempts. NOTE: this issue exists because of an incorrect fix for CVE-2006-5051.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.28601,"percentile":0.98129,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.ubuntu.com/usn/usn-649-1","tags":["vendor-advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45202","tags":["vdb-entry"]},{"url":"http://secunia.com/advisories/31885","tags":["third-party-advisory"]},{"url":"http://www.securitytracker.com/id?1020891","tags":["vdb-entry"]},{"url":"http://www.debian.org/security/2008/dsa-1638","tags":["vendor-advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00004.html","tags":["vendor-advisory"]},{"url":"http://secunia.com/advisories/32080","tags":["third-party-advisory"]},{"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=498678","tags":[]},{"url":"http://secunia.com/advisories/32181","tags":["third-party-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/01/3","tags":["mailing-list"]}],"priority":{"score":24.6,"factors":[{"name":"EPSS percentile","points":19.63},{"name":"Public exploit code","points":5.0}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2024-07-01","earliestUrl":"https://github.com/bigb0x/CVE-2024-6387","repos":[{"name":"bigb0x/CVE-2024-6387","url":"https://github.com/bigb0x/CVE-2024-6387","stars":35,"created":"2024-07-01"}]},"first":{"date":"2024-07-01","source":"PoC-in-GitHub","url":"https://github.com/bigb0x/CVE-2024-6387"},"provenance":"source"},"euvd":{"id":"EUVD-2008-4092","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-red-hat-enterprise-linux-9-cve-2006-5051","parents":[{"from":"CVE-2006-5051","to":"CVE-2008-4109","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incorrect fix for CVE-2006-5051.","from":"CVE.org","in":"CVE-2008-4109"}]}]}}