CVE-2006-5051

Advisory lineage Upstream: 0 Downstream: 7
Modified
Published: 27 Sept 2006, 23:00
Last modified:07 Aug 2024, 19:32

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.3 HIGH
v2.0 (nvd)
EPSS Score
2.55% LOW
3% probability +0.34%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

27 Sept 2006, 23:00
Published
Vulnerability first disclosed
07 Aug 2024, 19:32
Last Modified
Vulnerability information updated

Description

Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecified vectors that lead to a double-free.

CVSS Metrics

  • v3.1•HIGH•Score: 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v2.0•HIGH•Score: 9.3AV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 2.55%• Percentile: 86%

Techniques & Countermeasures

  • CWE-415•Double Free

    The product calls free() twice on the same memory address.

Affected Systems

  • apple•mac_os_x

    < 10.3.9 | ≥ 10.4, ≤ 10.4.8

  • apple•mac_os_x_server

    < 10.3.9 | ≥ 10.4, ≤ 10.4.8

  • debian•debian_linux

    3.1

  • openbsd•openssh

    ≤ 4.4

References (58)