Several remote vulnerabilities have been discovered in OpenSSH, a free implementation of the Secure Shell protocol, which may lead to denial of service and potentially the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-4924     Tavis Ormandy of the Google Security Team discovered a     denial of service vulnerability in the mitigation code     against complexity attacks, which might lead to     increased CPU consumption until a timeout is triggered.
    This is only exploitable if support for SSH protocol     version 1 is enabled.

  - CVE-2006-5051     Mark Dowd discovered that insecure signal handler usage     could potentially lead to execution of arbitrary code     through a double free. The Debian Security Team doesn't     believe the general openssh package without Kerberos     support to be exploitable by this issue. However, due to     the complexity of the underlying code we will issue an     update to rule out all eventualities.

The remote BIG-IP device is missing a patch required by a security advisory.

From Red Hat Security Advisory 2006:0697 :

Updated openssh packages that fix two security flaws are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. This package includes the core files necessary for both the OpenSSH client and server.

Mark Dowd discovered a signal handler race condition in the OpenSSH sshd server. A remote attacker could possibly leverage this flaw to cause a denial of service (crash). (CVE-2006-5051) The OpenSSH project believes the likelihood of successful exploitation leading to arbitrary code execution appears remote. However, the Red Hat Security Response Team have not yet been able to verify this claim due to lack of upstream vulnerability information. We are therefore including a fix for this flaw and have rated it important security severity in the event our continued investigation finds this issue to be exploitable.

Tavis Ormandy of the Google Security Team discovered a denial of service bug in the OpenSSH sshd server. A remote attacker can send a specially crafted SSH-1 request to the server causing sshd to consume a large quantity of CPU resources. (CVE-2006-4924)

All users of openssh should upgrade to these updated packages, which contain backported patches that resolves these issues.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0470 advisory.

    This advisory aggregates security fixes for the openssh SRPM in CIQ LTS 9.2. It addresses 21 CVEs:
    CVE-2006-4924, CVE-2023-51385, CVE-2016-6210, CVE-2016-1908, CVE-2023-48795, and 16 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several security problems were fixed in OpenSSH :

  - CVE-2006-4924: A denial of service problem has been     fixed in OpenSSH which could be used to cause lots of     CPU consumption on a remote openssh server.

  - CVE-2006-4925: If a remote attacker is able to inject     network traffic this could be used to cause a client     connection to close.

  - CVE-2006-5051: Fixed an unsafe signal hander reported by     Mark Dowd. The signal handler was vulnerable to a race     condition that could be exploited to perform a     pre-authentication denial of service. This vulnerability     could theoretically lead to pre-authentication remote     code execution if GSSAPI authentication is enabled, but     the likelihood of successful exploitation appears     remote.

  - CVE-2006-5052: Fixed a GSSAPI authentication abort that     could be used to determine the validity of usernames on     some platforms.

It has been discovered that the signal handler implementing the login timeout in Debian's version of the OpenSSH server uses functions which are not async-signal-safe, leading to a denial of service vulnerability (CVE-2008-4109 ).

The problem was originally corrected in OpenSSH 4.4p1 (CVE-2006-5051 ), but the patch backported to the version released with etch was incorrect.

Systems affected by this issue suffer from lots of zombie sshd processes. Processes stuck with a '[net]' process title have also been observed. Over time, a sufficient number of processes may accumulate such that further login attempts are impossible. Presence of these processes does not indicate active exploitation of this vulnerability.
It is possible to trigger this denial of service condition by accident.

According to its banner, the version of OpenSSH installed on the remote host is affected by multiple vulnerabilities :

  - A race condition exists that may allow an     unauthenticated, remote attacker to crash the service     or, on portable OpenSSH, possibly execute code on the     affected host.  Note that successful exploitation     requires that GSSAPI authentication be enabled.
    
  - A flaw exists that may allow an attacker to determine     the validity of usernames on some platforms. Note that     this issue requires that GSSAPI authentication be     enabled.

  - When SSH version 1 is used, an issue can be triggered     via an SSH packet that contains duplicate blocks that     could result in a loss of availability for the service.

  - On Fedora Core 6 (and possibly other systems), an     unspecified vulnerability in the     linux_audit_record_event() function allows remote     attackers to inject incorrect information into     audit logs.

The remote NewStart CGSL host, running version MAIN 6.06, has openssh packages installed that are affected by multiple vulnerabilities:

  - The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and     relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a     fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11     server, as demonstrated by lack of the SECURITY extension on this X11 server. (CVE-2016-1908)

  - Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service     (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecified vectors     that lead to a double-free. (CVE-2006-5051)

  - scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell     metacharacters or spaces, which are expanded twice. (CVE-2006-0225)

  - sshd in OpenSSH before 4.4, when using the version 1 SSH protocol, allows remote attackers to cause a     denial of service (CPU consumption) via an SSH packet that contains duplicate blocks, which is not     properly handled by the CRC compensation attack detector. (CVE-2006-4924)

  - Unspecified vulnerability in the sshd Privilege Separation Monitor in OpenSSH before 4.5 causes weaker     verification that authentication has been successful, which might allow attackers to bypass     authentication. NOTE: as of 20061108, it is believed that this issue is only exploitable by leveraging     vulnerabilities in the unprivileged process, which are not known to exist. (CVE-2006-5794)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06 (SP), has openssh packages installed that are affected by multiple vulnerabilities:

  - The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and     relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a     fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11     server, as demonstrated by lack of the SECURITY extension on this X11 server. (CVE-2016-1908)

  - Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service     (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecified vectors     that lead to a double-free. (CVE-2006-5051)

  - scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell     metacharacters or spaces, which are expanded twice. (CVE-2006-0225)

  - sshd in OpenSSH before 4.4, when using the version 1 SSH protocol, allows remote attackers to cause a     denial of service (CPU consumption) via an SSH packet that contains duplicate blocks, which is not     properly handled by the CRC compensation attack detector. (CVE-2006-4924)

  - Unspecified vulnerability in the sshd Privilege Separation Monitor in OpenSSH before 4.5 causes weaker     verification that authentication has been successful, which might allow attackers to bypass     authentication. NOTE: as of 20061108, it is believed that this issue is only exploitable by leveraging     vulnerabilities in the unprivileged process, which are not known to exist. (CVE-2006-5794)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
22731	Debian DSA-1189-1 : openssh-krb5 - several vulnerabilities	Nessus	Debian Local Security Checks	2006/10/14	2021/1/4	high
88441	F5 Networks BIG-IP : OpenSSH vulnerabilities (SOL6736)	Nessus	F5 Networks Local Security Checks	2016/1/28	2021/1/11	high
67412	Oracle Linux 4 : openssh (ELSA-2006-0697)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
354271	Rocky Linux 9.2 [CIQ] Security Update: openssh / openssh-askpass / openssh-askpass-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0470)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical
27365	openSUSE 10 Security Update : openssh (openssh-2183)	Nessus	SuSE Local Security Checks	2007/10/17	2021/1/14	high
34223	Debian DSA-1638-1 : openssh - denial of service	Nessus	Debian Local Security Checks	2008/9/17	2021/1/4	high
22466	OpenSSH < 4.4 Multiple Vulnerabilities	Nessus	Misc.	2006/9/28	2024/3/27	high
266250	NewStart CGSL MAIN 6.06 : openssh Multiple Vulnerabilities (NS-SA-2025-0210)	Nessus	NewStart CGSL Local Security Checks	2025/9/30	2025/9/30	critical
301236	NewStart CGSL MAIN 6.06 (SP) : openssh Multiple Vulnerabilities (NS-SA-2026-0003)	Nessus	NewStart CGSL Local Security Checks	2026/3/6	2026/3/6	critical

检测

插件搜索

high

high

high

critical

high

high

high

critical

critical